CVE-2023-0466 Certificate policy check not enabled

🗓️ 28 Mar 2023 14:30:49Reported by GoogleType

osv🔗 osv.dev👁 35 Views

Function X509_VERIFY_PARAM_add0_policy() fails to enable certificate policy check, allowing invalid certificates to pass verification. Applications needing policy check should use X509_VERIFY_PARAM_set1_policies() or X509_VERIFY_PARAM_set_flags() with X509_V_FLAG_POLICY_CHECK

Source	Link
openwall	www.openwall.com/lists/oss-security/2023/09/28/4
lists	www.lists.debian.org/debian-lts-announce/2023/06/msg00011.html
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0466.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-0466
security	www.security.gentoo.org/glsa/202402-08
security	www.security.netapp.com/advisory/ntap-20230414-0001/
debian	www.debian.org/security/2023/dsa-5417
openssl	www.openssl.org/news/secadv/20230328.txt
git	www.git.openssl.org/gitweb/
git	www.git.openssl.org/gitweb/

12 Aug 2026 13:32Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.15.3