CVE-2021-46880

Katalog CVE

CVSS 9.8 · Critical EPSS 0,57%

Kerentanan Improper Certificate Validation pada openbsd libressl, openbsd. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

x509/x509_verify.c in LibreSSL before 3.4.2, and OpenBSD before 7.0 errata 006, allows authentication bypass because an error for an unverified certificate chain is sometimes discarded.

Rincian

Terbit di NVD

15 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation

EPSS (30 hari)

0,57% peluang dieksploitasi; lebih tinggi dari 45,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://ftp.openbsd.org/pub/OpenBSD/patches/7.0/common/006_x509.patch.sig patch
• https://github.com/openbsd/src/commit/3f851282810fa0ab4b90b3b1ecec2e8717ef16f8 patch
• https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.4.2-relnotes.txt release notes
• https://security.netapp.com/advisory/ntap-20230517-0006/