openssl - security update

Fixed packages 1

Vulnerabilities 4

• High 7.5
  CVE-2023-0464 Public exploit

  Excessive Resource Usage Verifying X.509 Policy Constraints

  A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate …

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 22, 2023
• Medium 6.5
  CVE-2023-2650 EPSS 75%

  Possible DoS translating ASN.1 object identifiers

  Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with …

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  May 30, 2023
• Medium 5.3
  CVE-2023-0465

  Invalid certificate policies in leaf certificates are silently ignored

  Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate pol…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 28, 2023
• Medium 5.3
  CVE-2023-0466

  Certificate policy check not enabled

  The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or in…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine
  Mar 28, 2023