CVE-2021-46880 — Improper Certificate Validation in Libressl

CWE-295 — Improper Certificate Validation3 documents3 sources
Severity
9.8CRITICALNVD
EPSS
0.1%
top 84.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Openbsd LibresslOpenbsd
Timeline
PublishedApr 15

Description

x509/x509_verify.c in LibreSSL before 3.4.2, and OpenBSD before 7.0 errata 006, allows authentication bypass because an error for an unverified certificate chain is sometimes discarded.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDopenbsd/libressl< 3.4.2
▶NVDopenbsd/openbsd< 7.0

Patches

Patch: ftp.openbsd.org ↗Patch: github.com ↗Patch: ftp.openbsd.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-j4x4-2cc8-7274: x509/x509_verify↗2023-04-15
▶
CVEList
CVE-2021-46880: x509/x509_verify↗2023-04-14
▶