Homepage

Improper Certificate Validation The advisory has been revoked - it doesn't affect any version of package openssl  (opens in a new tab)

Threat Intelligence

EPSS
1.58% (73rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU2604-OPENSSL-16219036
  • published24 Apr 2026
  • disclosed28 Mar 2023
Report a new vulnerability Found a mistake?

Introduced: 28 Mar 2023

CVE-2023-0465  (opens in a new tab)
CWE-295  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:26.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu.

Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks.

Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether.

Policy processing is disabled by default but can be enabled by passing the -policy' argument to the command line utilities or by calling the X509_VERIFY_PARAM_set1_policies()' function.