CVE-2023-0464
Excessive Resource Usage Verifying X.509 Policy Constraints
- Published
- Updated
- Reserved
- Assigned by
- openssl
Description
A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Modified | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 4.0% · top 9.5% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Weakness
- inefficient algorithmic complexity
- CWE-295 Improper Certificate Validation (opens in a new tab)All about CWE-295 and its CVEs
Affected products
References (21)
- OpenSSL Advisory (opens in a new tab)vendor-advisoryx_transferred
- 3.1.1 git commit (opens in a new tab)patchx_transferred
- 3.0.9 git commit (opens in a new tab)patchx_transferred
- 1.1.1u git commit (opens in a new tab)patchx_transferred
- 1.0.2zh patch (premium) (opens in a new tab)patchx_transferred
- https://www.couchbase.com/alerts/ (opens in a new tab)x_transferred
- https://www.debian.org/security/2023/dsa-5417 (opens in a new tab)x_transferred
- https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html (opens in a new tab)x_transferred
- https://security.gentoo.org/glsa/202402-08 (opens in a new tab)x_transferred
- https://security.netapp.com/advisory/ntap-20240621-0006/ (opens in a new tab)x_transferred
- https://security.netapp.com/advisory/ntap-20230406-0006/ (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-794697.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-077170.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-556635.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-879734.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-625862.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-337522.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-341067.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-769027.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-028723.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-0464)Record last updated .