CVE-2015-1793
high-risk
Published 2015-07-09
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.
Do I need to act?
!
76.4% chance of exploitation in next 30 days
EPSS score — higher than 24% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.5/10
Medium
NETWORK
/ LOW complexity
Affected Products (10)
References (62)
Vendor Advisory
http://openssl.org/news/secadv_20150709.txt
and 42 more references
60
/ 100
high-risk
Severity
24/34 · High
Exploitability
20/34 · Moderate
Exposure
16/34 · Moderate