Lucene search

MitreCVE-2017-8301

HistoryApr 27, 2017 - 5:59 p.m.

CVE-2017-8301

2017-04-2717:59:00

CWE-295

mitre

web.nvd.nist.gov

cve-2017-8301

libressl

tls certificate verification

ssl_get_verify_result

nginx

security vulnerability

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

AI Score

5.2

Confidence

High

EPSS

0.002

Percentile

59.1%

JSON

LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied upon for a later check of a verification result, in a use case where a user-provided verification callback returns 1, as demonstrated by acceptance of invalid certificates by nginx.

Affected configurations

Nvd

Node

openbsdlibresslMatch2.5.1

openbsdlibresslMatch2.5.2

openbsdlibresslMatch2.5.3

VendorProductVersionCPE
openbsdlibressl2.5.1cpe:2.3:a:openbsd:libressl:2.5.1:*:*:*:*:*:*:*
openbsdlibressl2.5.2cpe:2.3:a:openbsd:libressl:2.5.2:*:*:*:*:*:*:*
openbsdlibressl2.5.3cpe:2.3:a:openbsd:libressl:2.5.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
openbsd	libressl	2.5.1	cpe:2.3:a:openbsd:libressl:2.5.1:::::::*
openbsd	libressl	2.5.2	cpe:2.3:a:openbsd:libressl:2.5.2:::::::*
openbsd	libressl	2.5.3	cpe:2.3:a:openbsd:libressl:2.5.3:::::::*

References

seclists.org/oss-sec/2017/q2/145

www.securityfocus.com/bid/98076

github.com/libressl-portable/portable/issues/307

trac.nginx.org/nginx/ticket/1257

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

AI Score

5.2

Confidence

High

EPSS

0.002

Percentile

59.1%

JSON

Related for CVE-2017-8301