5.3

CVE-2023-0466: Certificate policy check not enabled

Modified
AliasesALPINE-CVE-2023-0466UBUNTU-CVE-2023-0466DEBIAN-CVE-2023-0466
Published 28-03-2023Last modified 14-10-2026

Vulnerability summary

CVE-2023-0466 is a medium (CVSS 5.3) Improper Certificate Validation vulnerability in openssl. EPSS estimates a 1.77% chance of exploitation in the next 30 days, higher than 78.1% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
1.77%
0%100%
Low · +0.15 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 20 · Related 20
DLA-3449-1DSA-5417-1MGASA-2023-0130OPENSUSE-SU-2024:12837-1OPENSUSE-SU-2024:12842-1OPENSUSE-SU-2024:12969-1

Timeline

  1. 28-03-2023
    PublishedVulnerability first disclosed.
  2. 14-10-2026
    Last modifiedVulnerability information updated.

Description

The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification. As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument. Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

1.77%

Chance of exploitation in the next 30 days

Percentile

78%

Versus all other CVEs

30-day change

Increase +0.15 pp

From 1.63% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard6 products
  • eco-dotnet-libssl-1.0-ld-so-confAll versions (No fix recorded)
  • opensslAll versions (No fix recorded)
  • openssl-provider-fipsAll versions (No fix recorded)
  • openssl-provider-fips-3.1.2All versions (No fix recorded)
  • ruby-3.1All versions (No fix recorded)
Ubuntu4 products
  • edk2All versions (No fix recorded) | < 2022.02-3ubuntu0.22.04.4
  • nodejsAll versions (No fix recorded)
  • openssl< 1.0.1f-1ubuntu2.27+esm7 | < 1.0.2g-1ubuntu4.20+esm7 | < 1.0.2g-1ubuntu4.fips.4.20.7 | All versions (No fix recorded) | < 1.1.1-1ubuntu2.1~18.04.22 | < 1.1.1-1ubuntu2.fips.2.1~18.04.22 | < 1.1.1f-1ubuntu2.18 | < 1.1.1f-1ubuntu2.fips.18 | < 3.0.2-0ubuntu1.9
  • openssl1.0< 1.0.2n-1ubuntu5.12
Wolfi3 products
  • opensslAll versions (No fix recorded)
  • ruby-3.1All versions (No fix recorded)
  • ruby-3.2All versions (No fix recorded)
Alpine1 product
  • openssl≥ 1.0.2, < 3.0.8-r3
Debian1 product
  • openssl< 3.0.9-1
Openssl1 product
  • openssl≥ 1.0.2, < 1.0.2zh | ≥ 1.1.1, < 1.1.1u | ≥ 3.0.0, < 3.0.9 | ≥ 3.1.0, < 3.1.1

6 vendors · 16 products

References

26 links
Show all 26 references