CVE-2023-0464

NameCVE-2023-0464
DescriptionA security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3449-1, DSA-5417-1, ELA-932-1, ELA-953-1
Debian Bugs1034720

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
openssl (PTS)jessie, jessie (lts)1.0.1t-1+deb8u22fixed
stretch (security)1.1.0l-1~deb9u6vulnerable
stretch (lts), stretch1.1.0l-1~deb9u10fixed
buster, buster (lts)1.1.1n-0+deb10u7fixed
buster (security)1.1.1n-0+deb10u6fixed
bullseye1.1.1w-0+deb11u1fixed
bullseye (security)1.1.1w-0+deb11u2fixed
bookworm3.0.15-1~deb12u1fixed
bookworm (security)3.0.14-1~deb12u2fixed
sid, trixie3.3.2-2fixed
openssl1.0 (PTS)stretch (security)1.0.2u-1~deb9u7vulnerable
stretch (lts), stretch1.0.2u-1~deb9u10fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
opensslsourcejessie1.0.1t-1+deb8u21ELA-953-1
opensslsourcestretch1.1.0l-1~deb9u9ELA-953-1
opensslsourcebuster1.1.1n-0+deb10u5DLA-3449-1
opensslsourcebullseye1.1.1n-0+deb11u5DSA-5417-1
opensslsource(unstable)3.0.9-11034720
openssl1.0sourcestretch1.0.2u-1~deb9u8ELA-932-1
openssl1.0source(unstable)(unfixed)

Notes

https://www.openssl.org/news/secadv/20230322.txt
https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=959c59c7a0164117e7f8366466a32bb1f8d77ff1 (openssl-3.0)
https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=879f7080d7e141f415c79eaa3a8ac4a3dad0348b (OpenSSL_1_1_1-stable)

Search for package or bug name: Reporting problems