CVE-2023-0464 Excessive Resource Usage Verifying X.509 Policy Constraints

What is CVE-2023-0464?

CVE-2023-0464 is a high-severity denial of service vulnerability in Openssl Openssl, published on 22 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A security vulnerability has been identified in all supported versions

of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems.

Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function.

Weakness: CWE-295

Which versions are affected by CVE-2023-0464?

It affects 1 product.

Products include Openssl Openssl.

How do I fix CVE-2023-0464?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-0464 being exploited?

There is no known exploitation of CVE-2023-0464 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Openssl Openssl

• CVE-2009-3245 Null dereference in n/a Critical 10.0
• CVE-2006-3738 Memory corruption in n/a Critical 10.0
• CVE-2026-63073 Untrusted Sender DN Used as Format String in CMP Response Validation Critical 9.8
• CVE-2016-6309 Use after free in n/a Critical 9.8
• CVE-2016-0799 Integer overflow in n/a Critical 9.8

All Openssl Openssl vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2023-0464, AZL-25709, AZL-26731, AZL-31141, AZL-34664, AZL-37680 and 23 more.