Microsoft security update for CVE-2023-0466
🔗 CVE IDs covered (1)
📋 Microsoft's advisory
EchelonGraph does not copy Microsoft's advisory page: its FAQ and remediation text are not shown here. Read the advisory on https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-0466. This page also shows what EchelonGraph holds for CVE-2023-0466, with the description from its CVE record, which the CVE Numbering Authority that assigned the CVE wrote: for a CVE Microsoft assigned, often in the words of Microsoft's own advisory.
🎯 Affected products5
- cbl2 hvloader 1.0.1-5 on CBL Mariner 2.0
- cbl2 hvloader 1.0.1-5 on CBL-Mariner 2.0
- cbl2 hvloader 1.0.1-6 on CBL Mariner 2.0
- cbl2 openssl 1.1.1k-23 on CBL Mariner 2.0
- cm1 openssl 1.1.1k-15 on CBL Mariner 1.0
✅ Updates Microsoft lists: 3 updates
3 rows: one per KB article or update, update type and fixed build. Their details are on Microsoft's advisory.
| KB article | Update | Fixed build |
|---|---|---|
| — | Security Update | 1.0.1-6 |
| — | Security Update | 1.1.1k-15 |
| — | Security Update | 1.1.1k-23 |
🧭 EchelonGraph on CVE-2023-0466
- EchelonGraph score
- 5.3 MEDIUM
- CISA KEV
- Not listed
- Fix status
- A fix is available — apply it.
Description from the CVE record (CVE.org), as published by its numbering authority
The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification. As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument. Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications.
Published by OpenSSL Software Foundation, the CVE Numbering Authority that assigned CVE-2023-0466, in its CVE record at CVE.org; reused under the CVE Program's Terms of Use (its licence and MITRE's copyright notice are in our Terms of Service).