OpenSSL
OpenSSL Security Releases - March 2023
openssl-2023-03 Mar 1, 2023 Source: Vendor
OpenSSL security advisories for March 2023, compiled from CVE.org records.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.cve.org/CVERecord?id=CVE-2023-0464
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
3 lines
Showing 1–3 of 3
CVE-2023-0464
BR2023-0000-031206
OpenSSL
unclaimed
A security vulnerability has been identified in all supported versions
of OpenSSL related to the verification of X.509 certificate chains
that include policy constraints. Attackers may be able to...
Credited as David Benjamin (Google)
CVE-2023-0465
BR2023-0000-031222
OpenSSL
unclaimed
Applications that use a non-default option when verifying certificates may be
vulnerable to an attack from a malicious CA to circumvent certain checks.
Invalid certificate policies in leaf certifi...
Credited as David Benjamin (Google)
CVE-2023-0466
BR2023-0000-031230
OpenSSL
unclaimed
The function X509_VERIFY_PARAM_add0_policy() is documented to
implicitly enable the certificate policy check when doing certificate
verification. However the implementation of the function does not...
Credited as David Benjamin (Google)