=====================================================================

                               CERT-Renater

                    Note d'Information No. 2023/VULN117

_____________________________________________________________________

DATE                : 28/03/2023

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running OpenSSL versions 3.1, 3.0, 1.1.1,
                                         1.0.2.

=====================================================================
https://www.openssl.org/news/secadv/20230328.txt
_____________________________________________________________________

OpenSSL Security Advisory [28th March 2023]
===========================================

Invalid certificate policies in leaf certificates are silently
ignored (CVE-2023-0465)
======================================================================================

Severity: Low

Applications that use a non-default option when verifying certificates
may be vulnerable to an attack from a malicious CA to circumvent
certain checks.

Invalid certificate policies in leaf certificates are silently
ignored by OpenSSL and other certificate policy checks are skipped
for that certificate.
A malicious CA could use this to deliberately assert invalid
certificate policies in order to circumvent policy checking on
the certificate altogether.

Policy processing is disabled by default but can be enabled by
passing the `-policy' argument to the command line utilities or by
calling the `X509_VERIFY_PARAM_set1_policies()' function.

Due to the low severity of this issue we are not issuing new releases
of OpenSSL at this time. The fix will be included in the next releases
when they become available. The fix is also available in commit
facfb1ab (for 3.1), commit 1dd43e07 (for 3.0), commit b013765a
(for 1.1.1) in the OpenSSL git repository, and commit 10325176
(for 1.0.2) in the OpenSSL git repository for premium customers.

This issue was reported on 12th January 2023 by David Benjamin (Google).
The fix was developed by Matt Caswell.


Certificate policy check not enabled (CVE-2023-0466)
====================================================

Severity: Low

The function X509_VERIFY_PARAM_add0_policy() is documented to
implicitly enable the certificate policy check when doing certificate
verification. However the implementation of the function does not
enable the check which allows certificates with invalid or incorrect
policies to pass the certificate verification.

As suddenly enabling the policy check could break existing deployments
it was decided to keep the existing behavior of the
X509_VERIFY_PARAM_add0_policy() function.

Instead the applications that require OpenSSL to perform
certificate policy check need to use X509_VERIFY_PARAM_set1_policies()
or explicitly enable the policy check by calling
X509_VERIFY_PARAM_set_flags() with the
X509_V_FLAG_POLICY_CHECK flag argument.

Certificate policy checks are disabled by default in OpenSSL
and are not commonly used by applications.

OpenSSL 3.1, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.

Applications need to be updated if they are affected by the issue.

Due to the low severity of this issue we are not creating a new
release at this time. The documentation fix is also available in
commit fc814a30 (for 3.1), commit 51e8a84c (for 3.0), commit
0d16b7e9 (for 1.1.1) in the OpenSSL git repository, and commit
73398dea (for 1.0.2) in the OpenSSL git repository for premium
customers.

This issue was reported on 12th January 2023 by David Benjamin
(Google).
The documentation fix was developed by Tomas Mraz.


General Advisory Notes
======================

URL for this Security Advisory:
https://www.openssl.org/news/secadv/20230328.txt

Note: the online version of the advisory may be updated with
additional details over time.

For details of OpenSSL severity classifications please see:
https://www.openssl.org/policies/secpolicy.html

OpenSSL 1.1.1 will reach end-of-life on 2023-09-11. After that
date security fixes for 1.1.1 will only be available to premium
support customers.

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================