Excessive Resource Usage Verifying X.509 Policy Constraints
CVE-2023-0464

7.5HIGH

Key Information:

Vendor: OpenSSL
Status: OpenSSL
Vendor: CVE Published:; 22 March 2023

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A vulnerability has been identified in the OpenSSL library affecting all supported versions, specifically concerning the verification of X.509 certificate chains with policy constraints. If exploited, this vulnerability can allow attackers to create a malicious certificate chain, leading to excessive computational resource usage and potentially causing denial-of-service (DoS) attacks. Policy processing is off by default but can be activated using certain command line utilities, creating a risk pathway for capable adversaries. It is crucial for organizations using OpenSSL to stay informed and apply necessary patches to mitigate this risk.

Affected Version(s)

OpenSSL 3.1.0 < 3.1.1

OpenSSL 3.0.0 < 3.0.9

OpenSSL 1.1.1 < 1.1.1u

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Openssl_1.1.1g_CVE-2023-0464
Created by Trinadh465