CVE-2023-0466

Certificate policy check not enabled

The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification. As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument. Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications.

We have discovered 26,461 live websites that are affected by CVE-2023-0466.

Test my site



Affected Software

Product  OpenSSL
Category Web Server Extensions
Vulnerable Domains26,461 live websites (3.95% of OpenSSL install base)
Vulnerable Versions
  • from 3 before 3.0.9
  • from 3.1 before 3.1.1
Vulnerable Versions Count9 versions ( 22.50% of all versions)



Details

  • Published - Mar 28, 2023
  • Updated - Feb 19, 2025

Credits

  • David Benjamin (Google) (reporter)
  • Tomas Mraz (remediation developer)

CVE-2023-0466 usage by Country

United States12,695 websites


France2,385 websites
Germany1,547 websites
Japan1,443 websites
GB891 websites
Canada880 websites
Finland691 websites
Netherlands637 websites
Italy442 websites
Hungary406 websites

CVE-2023-0466 usage by TLD

.com11,579 websites
.org1,244 websites
.net1,159 websites
.jp939 websites
.edu829 websites
.ca741 websites
.co.uk720 websites
.nl558 websites
.fi550 websites
.fr545 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2023-0466

Top websites that are affected by CVE-2023-0466. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***********.com United States*,***
***.***********.com United States*,***
*******.com United States*,***
******.***************.com United States*,***
****************.com United States**,***
**.***.au Australia**,***
***.edu United States**,***
*********.ch United States**,***
******.org Singapore**,***
********.org France**,***
See full domain list

FAQ

A total of 26,461 websites have been identified as vulnerable to CVE-2023-0466, discovered through global website indexing conducted by WebTechSurvey.
OpenSSL is susceptible to CVE-2023-0466 vulnerability.
OpenSSL versions before 3.1.1 are vulnerable to CVE-2023-0466.
Version 3.1.1 of OpenSSL addresses the CVE-2023-0466 security vulnerability.