CVE-2023-0466
Fixed in a distro release EPSS 2%CVSS 5.3
The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification. As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument. Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications.
Products: OpenSSL, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 9 | openssl | 1:3.0.7-16.el9_2 |
| AlmaLinux 9 | openssl-devel | 1:3.0.7-16.el9_2 |
| AlmaLinux 9 | openssl-libs | 1:3.0.7-16.el9_2 |
| AlmaLinux 9 | openssl-perl | 1:3.0.7-16.el9_2 |
| Alpine 3.17 | openssl | 3.0.8-r3 |
| Chainguard | libcrypto3 | 0 |
| Chainguard | libssl3 | 0 |
| Chainguard | openssl | 0 |
| Chainguard | openssl-config | 0 |
| Chainguard | openssl-dbg | 0 |
| Chainguard | openssl-dev | 0 |
| Chainguard | openssl-doc | 0 |
| Chainguard | openssl-engine-afalg | 0 |
| Chainguard | openssl-engine-capi | 0 |
| Chainguard | openssl-engine-loader-attic | 0 |
| Chainguard | openssl-engine-padlock | 0 |
| Chainguard | openssl-provider-fips | 0 |
| Chainguard | openssl-provider-fips-3.1.2 | 0 |
| Chainguard | openssl-provider-fips-3.1.2-dbg | 0 |
| Chainguard | openssl-provider-legacy | 0 |
| Chainguard | ruby-3.0 | 0 |
| Chainguard | ruby-3.0-dev | 0 |
| Chainguard | ruby-3.0-doc | 0 |
| Chainguard | ruby-3.1 | 0 |
| Chainguard | ruby-3.1-base | 0 |
| Chainguard | ruby-3.1-base-dev | 0 |
| Chainguard | ruby-3.1-dev | 0 |
| Chainguard | ruby-3.1-doc | 0 |
| Chainguard | ruby-3.2 | 0 |
| Chainguard | ruby-3.2-base | 0 |
| Chainguard | ruby-3.2-base-dev | 0 |
| Chainguard | ruby-3.2-dev | 0 |
| Chainguard | ruby-3.2-doc | 0 |
| Debian 10 | openssl | 1.1.1n-0+deb10u5 |
| Debian 11 | openssl | 1.1.1n-0+deb11u5 |
| Debian 12 | openssl | 3.0.9-1 |
| Debian 13 | openssl | 3.0.9-1 |
| Debian 14 | openssl | 3.0.9-1 |
| Red Hat Enterprise Linux 9 | openssl | 1:3.0.7-16.el9_2 |
| Red Hat Enterprise Linux 9 | openssl-debuginfo | 1:3.0.7-16.el9_2 |
| Red Hat Enterprise Linux 9 | openssl-debugsource | 1:3.0.7-16.el9_2 |
| Red Hat Enterprise Linux 9 | openssl-devel | 1:3.0.7-16.el9_2 |
| Red Hat Enterprise Linux 9 | openssl-libs | 1:3.0.7-16.el9_2 |
| Red Hat Enterprise Linux 9 | openssl-libs-debuginfo | 1:3.0.7-16.el9_2 |
| Red Hat Enterprise Linux 9 | openssl-perl | 1:3.0.7-16.el9_2 |
| Red Hat jboss core services 1 | jbcs-httpd24-curl | 0:8.4.0-2.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl | 0:8.4.0-2.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl-debuginfo | 0:8.4.0-2.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl-debuginfo | 0:8.4.0-2.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl | 0:8.4.0-2.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl | 0:8.4.0-2.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl-debuginfo | 0:8.4.0-2.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl-devel | 0:8.4.0-2.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl-devel | 0:8.4.0-2.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_http2 | 0:1.15.19-32.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_http2 | 0:1.15.19-32.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_http2-debuginfo | 0:1.15.19-32.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_http2-debuginfo | 0:1.15.19-32.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk | 0:1.2.49-1.redhat_1.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk | 0:1.2.49-1.redhat_1.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-ap24 | 0:1.2.49-1.redhat_1.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-ap24 | 0:1.2.49-1.redhat_1.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-ap24-debuginfo | 0:1.2.49-1.redhat_1.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-debuginfo | 0:1.2.49-1.redhat_1.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl | 1:1.1.1k-16.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl | 1:1.1.1k-16.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-debuginfo | 1:1.1.1k-16.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-debuginfo | 1:1.1.1k-16.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-devel | 1:1.1.1k-16.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-devel | 1:1.1.1k-16.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-libs | 1:1.1.1k-16.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-libs | 1:1.1.1k-16.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-libs-debuginfo | 1:1.1.1k-16.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-perl | 1:1.1.1k-16.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-perl | 1:1.1.1k-16.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-static | 1:1.1.1k-16.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-static | 1:1.1.1k-16.el7jbcs |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat | 0:9.0.62-19.redhat_00017.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat | 0:9.0.62-19.redhat_00017.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat | 0:9.0.62-19.redhat_00017.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-admin-webapps | 0:9.0.62-19.redhat_00017.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-admin-webapps | 0:9.0.62-19.redhat_00017.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-admin-webapps | 0:9.0.62-19.redhat_00017.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-docs-webapp | 0:9.0.62-19.redhat_00017.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-docs-webapp | 0:9.0.62-19.redhat_00017.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-docs-webapp | 0:9.0.62-19.redhat_00017.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-el-3.0-api | 0:9.0.62-19.redhat_00017.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-el-3.0-api | 0:9.0.62-19.redhat_00017.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-el-3.0-api | 0:9.0.62-19.redhat_00017.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-java-jdk11 | 0:9.0.62-19.redhat_00017.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-java-jdk8 | 0:9.0.62-19.redhat_00017.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-javadoc | 0:9.0.62-19.redhat_00017.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-javadoc | 0:9.0.62-19.redhat_00017.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-javadoc | 0:9.0.62-19.redhat_00017.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-jsp-2.3-api | 0:9.0.62-19.redhat_00017.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-jsp-2.3-api | 0:9.0.62-19.redhat_00017.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-jsp-2.3-api | 0:9.0.62-19.redhat_00017.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-lib | 0:9.0.62-19.redhat_00017.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-lib | 0:9.0.62-19.redhat_00017.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-lib | 0:9.0.62-19.redhat_00017.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-native | 0:1.2.31-16.redhat_16.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-native | 0:1.2.31-16.redhat_16.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-native | 0:1.2.31-16.redhat_16.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-native-debuginfo | 0:1.2.31-16.redhat_16.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-native-debuginfo | 0:1.2.31-16.redhat_16.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-native-debuginfo | 0:1.2.31-16.redhat_16.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-selinux | 0:9.0.62-19.redhat_00017.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-selinux | 0:9.0.62-19.redhat_00017.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-selinux | 0:9.0.62-19.redhat_00017.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-servlet-4.0-api | 0:9.0.62-19.redhat_00017.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-servlet-4.0-api | 0:9.0.62-19.redhat_00017.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-servlet-4.0-api | 0:9.0.62-19.redhat_00017.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-webapps | 0:9.0.62-19.redhat_00017.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-webapps | 0:9.0.62-19.redhat_00017.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-webapps | 0:9.0.62-19.redhat_00017.1.el8jws |
| SUSE Enterprise Storage 7 | openssl-1_0_0 | 1.0.2p-150000.3.73.1 |
| SUSE Enterprise Storage 7 | openssl-1_1 | 1.1.1d-150200.11.62.1 |
| SUSE Enterprise Storage 7.1 | openssl-1_0_0 | 1.0.2p-150000.3.73.1 |
| SUSE Enterprise Storage 7.1 | openssl-1_1 | 1.1.1d-150200.11.62.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | openssl-1_1 | 1.1.0i-150100.14.48.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | openssl-1_1 | 1.1.1d-150200.11.62.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS | openssl-1_0_0 | 1.0.2p-150000.3.73.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS | openssl-1_1 | 1.1.1d-150200.11.62.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | openssl-1_0_0 | 1.0.2p-150000.3.73.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | openssl-1_1 | 1.1.1d-150200.11.62.1 |
| SUSE Linux Enterprise Micro 5.1 | openssl-1_1 | 1.1.1d-150200.11.62.1 |
| SUSE Linux Enterprise Micro 5.2 | openssl-1_1 | 1.1.1d-150200.11.62.1 |
| SUSE Linux Enterprise Micro 5.3 | openssl-1_1 | 1.1.1l-150400.7.34.1 |
| SUSE Linux Enterprise Micro 5.4 | openssl-1_1 | 1.1.1l-150400.7.34.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP4 | openssl-1_1 | 1.1.1l-150400.7.34.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP4 | openssl-3 | 3.0.1-150400.4.23.1 |
| SUSE Linux Enterprise Module for Legacy 15 SP4 | openssl-1_0_0 | 1.0.2p-150000.3.73.1 |
| SUSE Linux Enterprise Real Time 15 SP3 | openssl-1_1 | 1.1.1d-150200.11.62.1 |
| SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE | openssl1 | 1.0.1g-0.58.62.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | openssl | 1.0.2j-60.92.1 |
| SUSE Linux Enterprise Server 12 SP4-ESPOS | openssl-1_0_0 | 1.0.2p-3.72.1 |
| SUSE Linux Enterprise Server 12 SP4-ESPOS | openssl-1_1 | 1.1.1d-2.81.1 |
| SUSE Linux Enterprise Server 12 SP4-LTSS | openssl-1_0_0 | 1.0.2p-3.72.1 |
| SUSE Linux Enterprise Server 12 SP4-LTSS | openssl-1_1 | 1.1.1d-2.81.1 |
| SUSE Linux Enterprise Server 12 SP5 | openssl-1_0_0 | 1.0.2p-3.72.1 |
| SUSE Linux Enterprise Server 12 SP5 | openssl-1_1 | 1.1.1d-2.81.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | openssl-1_0_0 | 1.0.2p-150000.3.73.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | openssl-1_1 | 1.1.0i-150100.14.48.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | openssl-1_0_0 | 1.0.2p-150000.3.73.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | openssl-1_1 | 1.1.1d-150200.11.62.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | openssl-1_0_0 | 1.0.2p-150000.3.73.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | openssl-1_1 | 1.1.1d-150200.11.62.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | openssl-1_0_0 | 1.0.2p-3.72.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | openssl-1_1 | 1.1.1d-2.81.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | openssl-1_0_0 | 1.0.2p-3.72.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | openssl-1_1 | 1.1.1d-2.81.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | openssl-1_0_0 | 1.0.2p-150000.3.73.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | openssl-1_1 | 1.1.0i-150100.14.48.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | openssl-1_0_0 | 1.0.2p-150000.3.73.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | openssl-1_1 | 1.1.1d-150200.11.62.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | openssl-1_0_0 | 1.0.2p-150000.3.73.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | openssl-1_1 | 1.1.1d-150200.11.62.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | openssl-1_0_0 | 1.0.2p-3.72.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | openssl-1_1 | 1.1.1d-2.81.1 |
| SUSE Manager Proxy 4.2 | openssl-1_1 | 1.1.1d-150200.11.62.1 |
| SUSE Manager Server 4.2 | openssl-1_1 | 1.1.1d-150200.11.62.1 |
| SUSE OpenStack Cloud 9 | openssl-1_0_0 | 1.0.2p-3.72.1 |
| SUSE OpenStack Cloud 9 | openssl-1_1 | 1.1.1d-2.81.1 |
| SUSE OpenStack Cloud Crowbar 9 | openssl-1_0_0 | 1.0.2p-3.72.1 |
| SUSE OpenStack Cloud Crowbar 9 | openssl-1_1 | 1.1.1d-2.81.1 |
| Ubuntu 18.04 LTS | openssl | 1.1.1-1ubuntu2.1~18.04.22 |
| Ubuntu 18.04 LTS | openssl1.0 | 1.0.2n-1ubuntu5.12 |
| Ubuntu 20.04 LTS | openssl | 1.1.1f-1ubuntu2.18 |
| Ubuntu 22.04 LTS | edk2 | 2022.02-3ubuntu0.22.04.4 |
| Ubuntu 22.04 LTS | openssl | 3.0.2-0ubuntu1.9 |
| Ubuntu 24.04 LTS | edk2 | 2024.02-2ubuntu0.6 |
| Ubuntu Pro 14.04 LTS | openssl | 1.0.1f-1ubuntu2.27+esm7 |
| Ubuntu Pro 16.04 LTS | edk2 | no fix |
| Ubuntu Pro 16.04 LTS | openssl | 1.0.2g-1ubuntu4.20+esm7 |
| Ubuntu Pro 18.04 LTS | edk2 | no fix |
| Ubuntu Pro 20.04 LTS | edk2 | no fix |
| Ubuntu Pro 22.04 LTS | nodejs | no fix |
| Ubuntu Pro FIPS-updates 16.04 LTS | openssl | 1.0.2g-1ubuntu4.fips.4.20.7 |
| Ubuntu Pro FIPS-updates 18.04 LTS | openssl | 1.1.1-1ubuntu2.fips.2.1~18.04.22 |
| Ubuntu Pro FIPS-updates 20.04 LTS | openssl | 1.1.1f-1ubuntu2.fips.18 |
| Ubuntu Pro FIPS 16.04 LTS | openssl | no fix |
| Ubuntu Pro FIPS 18.04 LTS | openssl | no fix |
| Ubuntu Pro FIPS 20.04 LTS | openssl | no fix |
| Wolfi | libcrypto3 | 0 |
| Wolfi | libssl3 | 0 |
| Wolfi | openssl | 0 |
| Wolfi | openssl-config | 0 |
| Wolfi | openssl-dbg | 0 |
| Wolfi | openssl-dev | 0 |
| Wolfi | openssl-doc | 0 |
| Wolfi | openssl-engine-afalg | 0 |
| Wolfi | openssl-engine-capi | 0 |
| Wolfi | openssl-engine-loader-attic | 0 |
| Wolfi | openssl-engine-padlock | 0 |
| Wolfi | openssl-provider-legacy | 0 |
| Wolfi | ruby-3.0 | 0 |
| Wolfi | ruby-3.0-dev | 0 |
| Wolfi | ruby-3.0-doc | 0 |
| Wolfi | ruby-3.1 | 0 |
| Wolfi | ruby-3.1-base | 0 |
| Wolfi | ruby-3.1-base-dev | 0 |
| Wolfi | ruby-3.1-dev | 0 |
| Wolfi | ruby-3.1-doc | 0 |
| Wolfi | ruby-3.2 | 0 |
| Wolfi | ruby-3.2-base | 0 |
| Wolfi | ruby-3.2-base-dev | 0 |
| Wolfi | ruby-3.2-dev | 0 |
| Wolfi | ruby-3.2-doc | 0 |
| openSUSE Leap 15.4 | openssl-1_0_0 | 1.0.2p-150000.3.73.1 |
| openSUSE Leap 15.4 | openssl-1_1 | 1.1.1l-150400.7.34.1 |
| openSUSE Leap 15.4 | openssl-3 | 3.0.1-150400.4.23.1 |
| openSUSE Leap Micro 5.3 | openssl-1_1 | 1.1.1l-150400.7.34.1 |
| openSUSE Tumbleweed | openssl-1_0_0 | 1.0.2u-15.1 |
| openSUSE Tumbleweed | openssl-1_1 | 1.1.1t-3.1 |
| openSUSE Tumbleweed | openssl-3 | 3.1.1-1.1 |