CVE-2023-0464 is a high-severity security vulnerability affecting all supported versions of OpenSSL, a widely used software library for secure communications. This flaw is related to the verification of X.509 certificate chains that include policy constraints, which may result in a denial-of-service (DoS) attack on affected systems. Systems using various OpenSSL versions, as well as certain Couchbase Server versions, are impacted by this vulnerability. It's essential for users to update their software to the latest versions to mitigate the risk.

How do I know if I'm affected?

If you're using OpenSSL or Couchbase Server, you might be affected by the vulnerability. For OpenSSL, the vulnerability impacts all supported versions, while for Couchbase Server, the affected versions are 7.2.0, 7.1.4, 7.1.3, 7.1.2, 7.1.1, 7.1.0, 7.0.x, 6.x, 5.x, 4.x, 3.x, and 2.x. To determine if you're affected, check the version of the software you're using and compare it to the mentioned affected versions.

What should I do if I'm affected?

If you're affected by the vulnerability, it's crucial to update your software to the latest version. For OpenSSL, apply the provided patches or upgrade your packages, depending on your system. For Couchbase Server, update to the fixed version mentioned in the security alert. Always keep your software up-to-date to minimize security risks.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-0464 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This vulnerability, known as the OpenSSL X.509 Certificate Chain Verification Vulnerability, was added to the National Vulnerability Database on March 22, 2023. It's important to update your software to the latest version to mitigate the risk.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-295, which involves improper validation of X.509 certificate chains, which can lead to a denial-of-service attack. To address this issue, update your software to the latest version.

For more details

CVE-2023-0464 is a significant security vulnerability affecting OpenSSL and Couchbase Server. By updating your software and staying informed, you can mitigate the risks associated with this flaw. For a comprehensive overview of the vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• OpenSSL Git Commit

• Debian LTS Security Update

• Debian Security Update

• Couchbase Alerts