Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com
☎ 03 60 47 09 81 - info@securiteinfo.com
A security vulnerability has been identified in all supported versionsof OpenSSL related to the verification of X.509 certificate chainsthat include policy constraints. Attackers may be able to exploit thisvulnerability by creating a malicious certificate chain that triggersexponential use of computational resources, leading to a denial-of-service(DoS) attack on affected systems.Policy processing is disabled by default but can be enabled by passingthe `-policy' argument to the command line utilities or by calling the`X509_VERIFY_PARAM_set1_policies()' function.
No PoCs from references.
- https://github.com/1g-v/DevSec_Docker_lab
- https://github.com/ARPSyndicate/cvemon
- https://github.com/L-ivan7/-.-DevSec_Docker
- https://github.com/PauloFariasLima8/DesafioDockerCompassUol
- https://github.com/Trinadh465/Openssl_1.1.1g_CVE-2023-0464
- https://github.com/chnzzh/OpenSSL-CVE-lib
- https://github.com/cloudogu/ces-build-lib
- https://github.com/fkie-cad/nvd-json-data-feeds
- https://github.com/jiione/Trivy-Monitor
- https://github.com/nomi-sec/PoC-in-GitHub
- https://github.com/ortelius/ms-textfile-crud
- https://github.com/seal-community/patches
- https://github.com/step-security-bot/Atelier-Logos_nabla