Summary
It was discovered that OpenSSL was not properly managing file locks when
processing policy constraints. If a user or automated system were tricked
into processing a certificate chain with specially crafted policy
constraints, a remote attacker could possibly use this issue to cause a
denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu
22.10. (CVE-2022-3996)
David Benjamin discovered that OpenSSL was not properly performing the
verification of X.509 certificate chains that include policy constraints,
which could lead to excessive resource consumption. If a user or automated
system were tricked into processing a specially crafted X.509 certificate
chain that includes policy constraints, a remote attacker could possibly
use this issue to cause a denial of service. (CVE-2023-0464)
David Benjamin discovered that OpenSSL was not properly handling invalid
certificate policies in leaf certificates, which would result in certain
policy checks being skipped for the certificate. If a user or automated
system were tricked into processing a specially crafted certificate, a
remote attacker could possibly use this issue to assert invalid
certificate policies and circumvent policy checking. (CVE-2023-0465)
David Benjamin discovered that OpenSSL incorrectly documented the
functionalities of function X509_VERIFY_PARAM_add0_policy, stating that
it would implicitly enable certificate policy checks when doing
certificate verifications, contrary to its implementation. This could
cause users and applications to not perform certificate policy checks
even when expected to do so. (CVE-2023-0466)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | openssl | 1.1.1-1ubuntu2.1~18.04.22 |
| Ubuntu · 18.04 LTS 18.04:LTS | openssl1.0 | 1.0.2n-1ubuntu5.12 |
| Ubuntu · 20.04 LTS 20.04:LTS | openssl | 1.1.1f-1ubuntu2.18 |
| Ubuntu · 22.04 LTS 22.04:LTS | openssl | 3.0.2-0ubuntu1.9 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | openssl | 1.0.1f-1ubuntu2.27+esm7 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | openssl | 1.0.2g-1ubuntu4.20+esm7 |
Vulnerabilities 3
-
High 7.5
X.509 Policy Constraints Double Locking
If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process …
-
High 7.5CVE-2023-0464 Public exploit
Excessive Resource Usage Verifying X.509 Policy Constraints
A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate …
-
Medium 5.3
Certificate policy check not enabled
The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or in…