Detections
Analytics

CBL Mariner 2.0 Security Update: edk2 / hvloader / openssl / nodejs18 (CVE-2023-0465)

medium Nessus Plugin ID 201673

Synopsis

The remote CBL Mariner host is missing one or more security updates.

Description

The version of edk2 / hvloader / openssl / nodejs18 installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-0465 advisory.

 - Applications that use a non-default option when verifying certificates May be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. (CVE-2023-0465)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://nvd.nist.gov/vuln/detail/CVE-2023-0465

Plugin Details

Severity: Medium

ID: 201673

File Name: mariner_CVE-2023-0465.nasl

Version: 1.1

Type: local

Published: 7/3/2024

Updated: 7/3/2024

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 1.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2023-0465

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: x-cpe:/o:microsoft:cbl-mariner, p-cpe:/a:microsoft:cbl-mariner:nodejs18-devel, p-cpe:/a:microsoft:cbl-mariner:openssl-static, p-cpe:/a:microsoft:cbl-mariner:openssl, p-cpe:/a:microsoft:cbl-mariner:nodejs18, p-cpe:/a:microsoft:cbl-mariner:edk2-ovmf, p-cpe:/a:microsoft:cbl-mariner:nodejs18-debuginfo, p-cpe:/a:microsoft:cbl-mariner:edk2-tools-doc, p-cpe:/a:microsoft:cbl-mariner:edk2-tools-python, p-cpe:/a:microsoft:cbl-mariner:edk2-tools, p-cpe:/a:microsoft:cbl-mariner:edk2-ovmf-ia32, p-cpe:/a:microsoft:cbl-mariner:edk2-debuginfo, p-cpe:/a:microsoft:cbl-mariner:openssl-debuginfo, p-cpe:/a:microsoft:cbl-mariner:openssl-perl, p-cpe:/a:microsoft:cbl-mariner:hvloader, p-cpe:/a:microsoft:cbl-mariner:edk2-ovmf-xen, p-cpe:/a:microsoft:cbl-mariner:edk2-ext4, p-cpe:/a:microsoft:cbl-mariner:openssl-libs, p-cpe:/a:microsoft:cbl-mariner:openssl-devel

Required KB Items: Host/local_checks_enabled, Host/CBLMariner/release, Host/CBLMariner/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 7/1/2024

Vulnerability Publication Date: 3/21/2023

Reference Information

CVE: CVE-2023-0465

IAVA: 2023-A-0158-S