Description
If an X.509 certificate contains a malformed policy constraint and
policy processing is enabled, then a write lock will be taken twice
recursively. On some operating systems (most widely: Windows) this
results in a denial of service when the affected process hangs. Policy
processing being enabled on a publicly facing server is not considered
to be a common setup.
Policy processing is enabled by passing the `-policy'
argument to the command line utilities or by calling the
`X509_VERIFY_PARAM_set1_policies()' function.
Update (31 March 2023): The description of the policy processing enablement
was corrected based on CVE-2023-0466.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenSSL | OpenSSL | 3.0.0 – ≤ 3.0.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssl | 3.0.7-2 | — |
| Debian 13 | openssl | 3.0.7-2 | — |
| Debian 12 | openssl | 3.0.7-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | openssl | 3.0.2-0ubuntu1.9 | USN-6039-1 |
| Ubuntu 20.04 LTS | openssl | 1.1.1f-1ubuntu2.18 | USN-6039-1 |
| Ubuntu 18.04 LTS | openssl | 1.1.1-1ubuntu2.1~18.04.22 | USN-6039-1 |
| Ubuntu 18.04 LTS | openssl1.0 | 1.0.2n-1ubuntu5.12 | USN-6039-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | edk2 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | openssl | 1.0.2g-1ubuntu4.20+esm7 | USN-6039-1 |
| Ubuntu Pro 14.04 LTS | openssl | 1.0.1f-1ubuntu2.27+esm7 | USN-6039-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | openssl-3 | 3.0.1-150400.4.14.1 | SUSE-SU-2022:4586-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openssl-3 | 3.0.7-2.1 | openSUSE-SU-2024:12573-1 |
| openSUSE Leap 15.4 | openssl-3 | 3.0.1-150400.4.14.1 | SUSE-SU-2022:4586-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | openssl | 3.0.7-r2 | — |
| Alpine v3.23 | openssl | 3.0.7-r2 | — |
| Alpine v3.22 | openssl | 3.0.7-r2 | — |
| Alpine v3.21 | openssl | 3.0.7-r2 | — |
| Alpine v3.20 | openssl | 3.0.7-r2 | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | openssl | 3.0.7-r2 | — |
| Alpine v3.18 | openssl | 3.0.7-r2 | — |
| Alpine v3.17 | openssl | 3.0.7-r2 | — |
| Alpine v3.16 | openssl3 | 3.0.8-r0 | — |
| Alpine v3.15 | openssl3 | 3.0.8-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | openssl +3 | 1:3.0.5-1.amzn2023.0.7 | ALAS2023-2023-095 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | edk2 | 20240223gitedc6681206c1-2 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | openssl | 3.0.7-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | openssl-src | >= 300.0.0, < 300.0.12 | 300.0.12 | GHSA-vr8j-hgmm-jh9r |
Advisories 5
- USN-6039-1 openssl, openssl1.0 vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
- openSUSE-SU-2024:12573-1 libopenssl-3-devel-3.0.7-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:4586-1 Security update for openssl-3 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-2310 OpenSSL: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 25, 2024
- ALAS2023-2023-095 Low: openssl security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 22, 2023