CVE-2023-0464 has a base score of 7.5 and base severity of HIGH in the NVD (attached).
That score and the description of the problem are misaligned in my opinion (meaning, I agree with the LOW severity - our app is not affected).
But there are project managers in our organization that use NVD as the reference, and seeing the HIGH, are requiring a 30 day remediation deadline.
Us devs are caught in the middle.
Best regards and thanks for all you do,
Mike Mueller
On Tue, Apr 4, 2023 at 7:06 PM Dr Paul Dale <pauli@xxxxxxxxxxx> wrote:
I was discussing CVE-2023-0466 which seemed to be the relevant one. Looking again, the table you included isn't overly clear (to me at least) what it's referring to.
Dr Paul Dale
On 5/4/23 09:02, Dr Paul Dale wrote:
We do not have a firm release date for 1.1.1u at this point. As per our policy, LOW severity CVE are not release triggering and this one is considered LOW severity by the project. Baring other eventualities, three months is a likely time frame.
I'll note that the issue here was in the documentation and that the fix is purely a documentation change. This change is already available online on our web site:
https://www.openssl.org/docs/man1.1.1/man3/X509_VERIFY_PARAM_set_flags.html
Dr Paul Dale
On 4/4/23 23:16, Joslin, Jack via openssl-users wrote:
Hello,
When will OpenSSL 1.1.1u be released?
Tenable indicates the vulnerability severity of 1.1.1t as medium. I found this post indicating that there is no ETA on the release of OpenSSL 1.1.1u and that it may not be released for 3 months.
From Nessus/Tenable scan:
Plugin Plugin Name Severity Plugin Output Solution Risk Factor CVE 173260 OpenSSL 1.1.1 < 1.1.1u Multiple Vulnerabilities Medium Plugin Output:
Banner : Apache/2.4.56 (Unix) OpenSSL/1.1.1t mod_perl/2.0.9 Perl/v5.8.8
Reported version : 1.1.1t
Fixed version : 1.1.1uUpgrade to OpenSSL version 1.1.1u or later. Medium CVE-2023-0464, CVE-2023-0464, CVE-2023-0465, CVE-2023-0466
Regards,Jack JoslinBusiness Services Outsourcing Center (BSOC)
General Dynamics, Information Technology
327 Columbia Turnpike, Rensselaer, NY 12144
m: +1.321.431.5117
Follow us on Facebook | Twitter | LinkedIn
This electronic message transmission contains information from GDIT which may be attorney-client privileged, proprietary or confidential. The information in this message is intended only for use by the individual(s) to whom it is addressed. If you believe you have received this message in error, please contact me immediately and be aware that any use, disclosure, copying or distribution of the contents of this message is strictly prohibited. NOTE: Regardless of content, this e-mail shall not operate to bind GDIT to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of e-mail for such purpose
urlOpenssl = https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=openssl&pubStartDate=2023-03-21T00:00:00.000&pubEndDate=2023-03-30T00:00:00.000 Openssl results: { "resultsPerPage": 3, "startIndex": 0, "totalResults": 3, "format": "NVD_CVE", "version": "2.0", "timestamp": "2023-04-04T12:49:39.487", "vulnerabilities": [ { "cve": { "id": "CVE-2023-0464", "sourceIdentifier": "openssl-security@xxxxxxxxxxx", "published": "2023-03-22T17:15:13.130", "lastModified": "2023-03-29T19:37:35.303", "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", "value": "A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function." } ], "metrics": { "cvssMetricV31": [ { "source": "nvd@xxxxxxxx", "type": "Primary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH" }, "exploitabilityScore": 3.9, "impactScore": 3.6 } ] }, "weaknesses": [ { "source": "nvd@xxxxxxxx", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-295" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.2", "versionEndExcluding": "1.0.2zh", "matchCriteriaId": "23F912E9-9126-4D16-8F77-BD41CED6774D" }, { "vulnerable": true, "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.1.1", "versionEndExcluding": "1.1.1u", "matchCriteriaId": "7D99C2F8-BE74-4912-8653-A2AEE387AAF9" }, { "vulnerable": true, "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0.0", "versionEndExcluding": "3.0.9", "matchCriteriaId": "4C637E94-F5EC-4D4B-836F-8C8219F1ECEC" }, { "vulnerable": true, "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1.0", "versionEndExcluding": "3.1.1", "matchCriteriaId": "68821BE0-7889-48B0-888D-CEC8BB9BDEA9" } ] } ] } ], "references": [ { "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2017771e2db3e2b96f89bbe8766c3209f6a99545";, "source": "openssl-security@xxxxxxxxxxx", "tags": [ "Mailing List", "Patch" ] }, { "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=879f7080d7e141f415c79eaa3a8ac4a3dad0348b";, "source": "openssl-security@xxxxxxxxxxx", "tags": [ "Mailing List", "Patch" ] }, { "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=959c59c7a0164117e7f8366466a32bb1f8d77ff1";, "source": "openssl-security@xxxxxxxxxxx", "tags": [ "Mailing List", "Patch" ] }, { "url": "https://www.openssl.org/news/secadv/20230322.txt";, "source": "openssl-security@xxxxxxxxxxx", "tags": [ "Vendor Advisory" ] } ] } }, { "cve": { "id": "CVE-2023-0465", "sourceIdentifier": "openssl-security@xxxxxxxxxxx", "published": "2023-03-28T15:15:06.820", "lastModified": "2023-03-28T16:28:12.823", "vulnStatus": "Undergoing Analysis", "descriptions": [ { "lang": "en", "value": "Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function." } ], "metrics": {}, "references": [ { "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=10325176f3d3e98c6e2b3bf5ab1e3b334de6947a";, "source": "openssl-security@xxxxxxxxxxx" }, { "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1dd43e0709fece299b15208f36cc7c76209ba0bb";, "source": "openssl-security@xxxxxxxxxxx" }, { "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=b013765abfa80036dc779dd0e50602c57bb3bf95";, "source": "openssl-security@xxxxxxxxxxx" }, { "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=facfb1ab745646e97a1920977ae4a9965ea61d5c";, "source": "openssl-security@xxxxxxxxxxx" }, { "url": "https://www.openssl.org/news/secadv/20230328.txt";, "source": "openssl-security@xxxxxxxxxxx" } ] } }, { "cve": { "id": "CVE-2023-0466", "sourceIdentifier": "openssl-security@xxxxxxxxxxx", "published": "2023-03-28T15:15:06.880", "lastModified": "2023-03-28T16:28:12.823", "vulnStatus": "Undergoing Analysis", "descriptions": [ { "lang": "en", "value": "The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification. As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument. Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications." } ], "metrics": {}, "references": [ { "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0d16b7e99aafc0b4a6d729eec65a411a7e025f0a";, "source": "openssl-security@xxxxxxxxxxx" }, { "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=51e8a84ce742db0f6c70510d0159dad8f7825908";, "source": "openssl-security@xxxxxxxxxxx" }, { "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=73398dea26de9899fb4baa94098ad0a61f435c72";, "source": "openssl-security@xxxxxxxxxxx" }, { "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc814a30fc4f0bc54fcea7d9a7462f5457aab061";, "source": "openssl-security@xxxxxxxxxxx" }, { "url": "https://www.openssl.org/news/secadv/20230328.txt";, "source": "openssl-security@xxxxxxxxxxx" } ] } } ] } Oracle Tuxedo results: { "resultsPerPage": 0, "startIndex": 0, "totalResults": 0, "format": "NVD_CVE", "version": "2.0", "timestamp": "2023-04-04T12:49:41.913", "vulnerabilities": [] }
