| Description: | Summary:
The remote host is missing an update for the Debian 'openssl' package(s) announced via the DSA-5417-1 advisory.
Vulnerability Insight:
Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit.
CVE-2023-0464
David Benjamin reported a flaw related to the verification of X.509 certificate chains that include policy constraints, which may result in denial of service.
CVE-2023-0465
David Benjamin reported that invalid certificate policies in leaf certificates are silently ignored. A malicious CA could take advantage of this flaw to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether.
CVE-2023-0466
David Benjamin discovered that the implementation of the X509_VERIFY_PARAM_add0_policy() function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification (contrary to its documentation).
CVE-2023-2650
It was discovered that processing malformed ASN.1 object identifiers or data may result in denial of service.
For the stable distribution (bullseye), these problems have been fixed in version 1.1.1n-0+deb11u5.
We recommend that you upgrade your openssl packages.
For the detailed security status of openssl please refer to its security tracker page at: [link moved to references]
Affected Software/OS:
'openssl' package(s) on Debian 11.
Solution:
Please install the updated package(s).
CVSS Score:
7.8
CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:C
|
