A new OpenSSL vulnerability
A new OpenSSL vulnerability
[Security] Posted Jul 9, 2015 13:42 UTC (Thu) by corbet
The OpenSSL project has disclosed a new
certificate validation vulnerability. "During certificate
verification, OpenSSL (starting from version 1.0.1n and 1.0.2b) will
attempt to find an alternative certificate chain if the first attempt to
build such a chain fails. An error in the implementation of this logic can
mean that an attacker could cause certain checks on untrusted certificates
to be bypassed, such as the CA flag, enabling them to use a valid leaf
certificate to act as a CA and 'issue' an invalid certificate.
"
This is thus a client-side, man-in-the-middle vulnerability.
Note that the affected versions of OpenSSL were released in mid-June; anybody with an older release should not be vulnerable.