2 lines
8.6 KiB
JSON
2 lines
8.6 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"OpenSSL","vendor":"OpenSSL","versions":[{"lessThan":"3.1.1","status":"affected","version":"3.1.0","versionType":"semver"},{"lessThan":"3.0.9","status":"affected","version":"3.0.0","versionType":"semver"},{"lessThan":"1.1.1u","status":"affected","version":"1.1.1","versionType":"custom"},{"lessThan":"1.0.2zh","status":"affected","version":"1.0.2","versionType":"custom"}]}],"source":"openssl-security@openssl.org"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"V3.1.5","status":"affected","version":"V3.1.0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"V3.1.5","status":"affected","version":"V3.1.0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"V3.1.5","status":"affected","version":"V3.1.0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"V3.1.5","status":"affected","version":"V3.1.0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"V1.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"V3.1.5","status":"affected","version":"V3.1.0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*","matchCriteriaId":"23F912E9-9126-4D16-8F77-BD41CED6774D","versionEndExcluding":"1.0.2zh","versionStartIncluding":"1.0.2","vulnerable":true},{"criteria":"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*","matchCriteriaId":"7D99C2F8-BE74-4912-8653-A2AEE387AAF9","versionEndExcluding":"1.1.1u","versionStartIncluding":"1.1.1","vulnerable":true},{"criteria":"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*","matchCriteriaId":"4C637E94-F5EC-4D4B-836F-8C8219F1ECEC","versionEndExcluding":"3.0.9","versionStartIncluding":"3.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*","matchCriteriaId":"68821BE0-7889-48B0-888D-CEC8BB9BDEA9","versionEndExcluding":"3.1.1","versionStartIncluding":"3.1.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The function X509_VERIFY_PARAM_add0_policy() is documented to\nimplicitly enable the certificate policy check when doing certificate\nverification. However the implementation of the function does not\nenable the check which allows certificates with invalid or incorrect\npolicies to pass the certificate verification.\n\nAs suddenly enabling the policy check could break existing deployments it was\ndecided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy()\nfunction.\n\nInstead the applications that require OpenSSL to perform certificate\npolicy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly\nenable the policy check by calling X509_VERIFY_PARAM_set_flags() with\nthe X509_V_FLAG_POLICY_CHECK flag argument.\n\nCertificate policy checks are disabled by default in OpenSSL and are not\ncommonly used by applications."}],"id":"CVE-2023-0466","lastModified":"2026-10-14T21:17:12.893","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2023-0466","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-02-19T17:11:17.280968Z","version":"2.0.3"}}]},"published":"2023-03-28T15:15:06.880","references":[{"source":"openssl-security@openssl.org","url":"http://www.openwall.com/lists/oss-security/2023/09/28/4"},{"source":"openssl-security@openssl.org","tags":["Mailing List","Patch"],"url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0d16b7e99aafc0b4a6d729eec65a411a7e025f0a"},{"source":"openssl-security@openssl.org","tags":["Mailing List","Patch"],"url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=51e8a84ce742db0f6c70510d0159dad8f7825908"},{"source":"openssl-security@openssl.org","tags":["Broken Link"],"url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=73398dea26de9899fb4baa94098ad0a61f435c72"},{"source":"openssl-security@openssl.org","tags":["Mailing List","Patch"],"url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc814a30fc4f0bc54fcea7d9a7462f5457aab061"},{"source":"openssl-security@openssl.org","url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html"},{"source":"openssl-security@openssl.org","url":"https://security.gentoo.org/glsa/202402-08"},{"source":"openssl-security@openssl.org","url":"https://security.netapp.com/advisory/ntap-20230414-0001/"},{"source":"openssl-security@openssl.org","url":"https://www.debian.org/security/2023/dsa-5417"},{"source":"openssl-security@openssl.org","tags":["Vendor Advisory"],"url":"https://www.openssl.org/news/secadv/20230328.txt"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2023/09/28/4"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"],"url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0d16b7e99aafc0b4a6d729eec65a411a7e025f0a"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"],"url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=51e8a84ce742db0f6c70510d0159dad8f7825908"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=73398dea26de9899fb4baa94098ad0a61f435c72"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"],"url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc814a30fc4f0bc54fcea7d9a7462f5457aab061"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://security.gentoo.org/glsa/202402-08"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://security.netapp.com/advisory/ntap-20230414-0001/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://www.debian.org/security/2023/dsa-5417"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.openssl.org/news/secadv/20230328.txt"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-337522.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-341067.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-556635.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-625862.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-769027.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-794697.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-879734.html"}],"sourceIdentifier":"openssl-security@openssl.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"nvd@nist.gov","type":"Primary"}]}
|