CVE-2023-0465 - CVE House

Back to Database

Status published Unknown CVE-2023-0465

Invalid certificate policies in leaf certificates are silently ignored

0 CVSS

Vulnerability Description

Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-0465

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

David Benjamin (Google)
Matt Caswell

References

More from OpenSSL

View All →

Out-of-bounds read in HTTP client no_proxy handling

Timing side-channel in SM2 algorithm on 64 bit ARM

Out-of-bounds read & write in RFC 3211 KEK Unwrap

NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function

Missing ASN1_TYPE validation in TS_RESP_verify_response() function

Affected Vendor

OpenSSL

View all reports →

Affected Software

OpenSSL

Vulnerable Versions:

3.1.0, 3.0.0, 1.1.1, 1.0.2

Timeline

Official Publish: March 28th, 2023

Last Modified: February 18th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.