Improper Trust of Self-Signed Certificates in Bitdefender Total Security HTTPS Scanning Functionality

CVE-2023-6056

What is CVE-2023-6056?

A notable vulnerability exists within Bitdefender Total Security's HTTPS scanning functionality, leading to an insecure trust model for self-signed certificates. Specifically, the product accepts certificates signed using the RIPEMD-160 hashing algorithm without conducting the necessary validation. This flaw facilitates potential man-in-the-middle (MITM) SSL attacks, allowing malicious actors to intercept and manipulate secure connections to arbitrary websites. Users of affected versions are urged to take precautionary measures to ensure their online security.

References