CVE-2023-0465 Invalid certificate policies in leaf certificates are silently ignored

What is CVE-2023-0465?

CVE-2023-0465 is a medium-severity vulnerability in Openssl Openssl, published on 28 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks.

Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether.

Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function.

Weakness: CWE-295

Which versions are affected by CVE-2023-0465?

It affects 1 product.

Products include Openssl Openssl.

How do I fix CVE-2023-0465?

Apply the vendor's patch.

Is CVE-2023-0465 being exploited?

There is no known exploitation of CVE-2023-0465 in the wild and no public exploit code.

Other vulnerabilities in Openssl Openssl

• CVE-2009-3245 Null dereference in n/a Critical 10.0
• CVE-2006-3738 Memory corruption in n/a Critical 10.0
• CVE-2026-63073 Untrusted Sender DN Used as Format String in CMP Response Validation Critical 9.8
• CVE-2016-6309 Use after free in n/a Critical 9.8
• CVE-2016-0799 Integer overflow in n/a Critical 9.8

All Openssl Openssl vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2023-0465, AZL-25937, AZL-27241, AZL-31145, AZL-34663, AZL-37716 and 7 more.