Debian Security Advisory

DSA-5417-1 openssl -- security update

Date Reported:
31 May 2023
Affected Packages:
Security database references:
In the Debian bugtracking system: Bug 1034720.
In Mitre's CVE dictionary: CVE-2023-0464, CVE-2023-0465, CVE-2023-0466, CVE-2023-2650.
More information:

Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit.

  • CVE-2023-0464

    David Benjamin reported a flaw related to the verification of X.509 certificate chains that include policy constraints, which may result in denial of service.

  • CVE-2023-0465

    David Benjamin reported that invalid certificate policies in leaf certificates are silently ignored. A malicious CA could take advantage of this flaw to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether.

  • CVE-2023-0466

    David Benjamin discovered that the implementation of the X509_VERIFY_PARAM_add0_policy() function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification (contrary to its documentation).

  • CVE-2023-2650

    It was discovered that processing malformed ASN.1 object identifiers or data may result in denial of service.

For the stable distribution (bullseye), these problems have been fixed in version 1.1.1n-0+deb11u5.

We recommend that you upgrade your openssl packages.

For the detailed security status of openssl please refer to its security tracker page at: