CVE-2015-1793
CVE-2015-1793
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Esta página muestra una selección de datos de las fuentes. Consulte los avisos enlazados para ver la descripción completa y las versiones afectadas.
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.
CVSS 6.5 · Media · EPSS 58,2% · Código de explotación público · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: system · network
Productos y versiones afectados
n/a
- Versiones
- n/a: Afectada
Sin corrección publicada
openssl Debian:12
- Intervalos de versiones afectados
- ECOSYSTEM: < 1.0.2d-1
Actualiza a 1.0.2d-1
openssl Debian:13
- Intervalos de versiones afectados
- ECOSYSTEM: < 1.0.2d-1
Actualiza a 1.0.2d-1
openssl Debian:14
- Intervalos de versiones afectados
- ECOSYSTEM: < 1.0.2d-1
Actualiza a 1.0.2d-1
Fuentes originales
- http://marc.info/?l=bugtraq&m=143880121627664&w=2
- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04822825
- http://www.securitytracker.com/id/1032817
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- https://security.gentoo.org/glsa/201507-15
- http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-454058.htm
- http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150710-openssl
- https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=9a0db453ba017ebcaccbee933ee6511a9ae4d1c8
- https://www.freebsd.org/security/advisories/FreeBSD-SA-15:12.openssl.asc
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05184351
- http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161747.html
- http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- http://openssl.org/news/secadv_20150709.txt
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes
- http://marc.info/?l=bugtraq&m=144370846326989&w=2
- http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161782.html
- http://fortiguard.com/advisory/2015-07-09-cve-2015-1793-openssl-alternative-chains-certificate-forgery
- https://kc.mcafee.com/corporate/index?page=content&id=SB10125
- http://www.fortiguard.com/advisory/2015-07-09-cve-2015-1793-openssl-alternative-chains-certificate-forgery
- https://nvd.nist.gov/vuln/detail/CVE-2015-1793