🛡️ AZL-25936 — openssl

⚪ Unknown ✅ No Known Exploit OSV
N/A
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

CVE-2023-0466 affecting package openssl for versions less than 1.1.1k-23

The function X509_VERIFY_PARAM_add0_policy() is documented to

implicitly enable the certificate policy check when doing certificate

verification. However the implementation of the function does not

enable the check which allows certificates with invalid or incorrect

policies to pass the certificate verification.

As suddenly enabling the policy check could break existing deployments it was

decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy()

function.

Instead the applications that require OpenSSL to perform certificate

policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly

enable the policy check by calling X509_VERIFY_PARAM_set_flags() with

the X509_V_FLAG_POLICY_CHECK flag argument.

Certificate policy checks are disabled by default in OpenSSL and are not

commonly used by applications.

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs no privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality none, integrity low, availability none.

Affected software

AZL-25936 is recorded against 1 package.

  • openssl (fixed in 1.1.1k-23)

Timeline and source

Published on 28 March 2023 and last revised on 21 April 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

nvd.nist.gov (Web)

Details

Severity Unknown
CVSS Score N/A
CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE N/A
Public Exploit ✅ No
Source OSV
Published 2023-03-28
Updated 2026-08-12
Modified 2026-04-21
Fix URL N/A

Affected Packages

Software From version Fixed in
openssl — 1.1.1k-23

Free Vulnerability Check

Is your site affected by AZL-25936?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against AZL-25936 and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.