Bitdefender Total Security Vulnerability Affects HTTPS Scanning Functionality

CVE-2023-6055

What is CVE-2023-6055?

A security flaw has been discovered in the HTTPS scanning feature of Bitdefender Total Security, where the software inadequately validates website certificates. The issue arises when a site certificate does not possess the 'Server Authentication' specification in its Extended Key Usage extension. As a result, Bitdefender's software mistakenly considers such non-compliant certificates as valid. This vulnerability has the potential to enable attackers to execute Man-in-the-Middle (MITM) attacks, which could lead to unauthorized interception and modification of user communications with websites. Users are encouraged to stay updated with patches provided by Bitdefender to mitigate this risk.

References