Debian Security Advisory
DLA-3449-1 openssl -- LTS security update
- Date Reported:
- 08 Jun 2023
- Affected Packages:
- Security database references:
- In the Debian bugtracking system: Bug 1034720.
In Mitre's CVE dictionary: CVE-2023-0464, CVE-2023-0465, CVE-2023-0466, CVE-2023-2650.
- More information:
Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit.
David Benjamin reported a flaw related to the verification of X.509 certificate chains that include policy constraints, which may result in denial of service.
David Benjamin reported that invalid certificate policies in leaf certificates are silently ignored. A malicious CA could take advantage of this flaw to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether.
David Benjamin discovered that the implementation of the X509_VERIFY_PARAM_add0_policy() function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification (contrary to its documentation).
It was discovered that processing malformed ASN.1 object identifiers or data may result in denial of service.
For Debian 10 buster, these problems have been fixed in version 1.1.1n-0+deb10u5.
We recommend that you upgrade your openssl packages.
For the detailed security status of openssl please refer to its security tracker page at: https://security-tracker.debian.org/tracker/openssl
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS