漏洞标题
证书政策检查未启用
漏洞描述信息
证书策略检查未启用
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
漏洞类别
N/A
漏洞标题
Certificate policy check not enabled
漏洞描述信息
The function X509_VERIFY_PARAM_add0_policy() is documented to
implicitly enable the certificate policy check when doing certificate
verification. However the implementation of the function does not
enable the check which allows certificates with invalid or incorrect
policies to pass the certificate verification.
As suddenly enabling the policy check could break existing deployments it was
decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy()
function.
Instead the applications that require OpenSSL to perform certificate
policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly
enable the policy check by calling X509_VERIFY_PARAM_set_flags() with
the X509_V_FLAG_POLICY_CHECK flag argument.
Certificate policy checks are disabled by default in OpenSSL and are not
commonly used by applications.
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
OpenSSL 信任管理问题漏洞
漏洞描述信息
OpenSSL是OpenSSL团队的一个开源的能够实现安全套接层（SSLv2/v3）和安全传输层（TLSv1）协议的通用加密库。该产品支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。 OpenSSL存在信任管理问题漏洞，该漏洞源于在进行证书验证时隐式启用证书策略检查，允许策略无效或不正确的证书通过证书验证的检查。
CVSS信息
N/A
漏洞类别
信任管理问题