Detections
Analytics
Debian dla-3449 : libssl-dev - security update
critical Nessus Plugin ID 176985
Language:
Synopsis
The remote Debian host is missing one or more security-related updates.Description
The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3449 advisory.- ------------------------------------------------------------------------- Debian LTS Advisory DLA-3449-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler June 08, 2023 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : openssl Version : 1.1.1n-0+deb10u5 CVE ID : CVE-2023-0464 CVE-2023-0465 CVE-2023-0466 CVE-2023-2650 Debian Bug : 1034720
Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit.
CVE-2023-0464
David Benjamin reported a flaw related to the verification of X.509 certificate chains that include policy constraints, which may result in denial of service.
CVE-2023-0465
David Benjamin reported that invalid certificate policies in leaf certificates are silently ignored. A malicious CA could take advantage of this flaw to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether.
CVE-2023-0466
David Benjamin discovered that the implementation of the X509_VERIFY_PARAM_add0_policy() function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification (contrary to its documentation).
CVE-2023-2650
It was discovered that processing malformed ASN.1 object identifiers or data may result in denial of service.
For Debian 10 buster, these problems have been fixed in version 1.1.1n-0+deb10u5.
We recommend that you upgrade your openssl packages.
For the detailed security status of openssl please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/openssl
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS
Tenable has extracted the preceding description block directly from the Debian security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade the libssl-dev packages.See Also
https://security-tracker.debian.org/tracker/source-package/openssl
https://security-tracker.debian.org/tracker/CVE-2023-0464
https://security-tracker.debian.org/tracker/CVE-2023-0465
https://security-tracker.debian.org/tracker/CVE-2023-0466
Plugin Details
Severity: Critical
ID: 176985
File Name: debian_DLA-3449.nasl
Version: 1.2
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 6/8/2023
Updated: 1/22/2025
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2023-0466
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Temporal Score: 4.6
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Critical
Base Score: 9.3
Threat Score: 8.1
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score Source: CVE-2023-2650
Vulnerability Information
CPE: cpe:/o:debian:debian_linux:10.0, p-cpe:/a:debian:debian_linux:libssl-dev, p-cpe:/a:debian:debian_linux:libssl-doc, p-cpe:/a:debian:debian_linux:openssl, p-cpe:/a:debian:debian_linux:libssl1.1
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Ease: No known exploits are available
Patch Publication Date: 6/8/2023
Vulnerability Publication Date: 3/21/2023
Reference Information
CVE: CVE-2023-0464, CVE-2023-0465, CVE-2023-0466, CVE-2023-2650
IAVA: 2023-A-0158-S