---
id: CVE-2023-0465
title: |-
  Applications that use a non-default option when verifying certificates may be
  vulnerable to an attack from a malicious CA to circumvent certain checks.

  Invalid certificate policies in leaf certificates are silently ignored by
  OpenSSL an…
summary: |-
  Applications that use a non-default option when verifying certificates may be
  vulnerable to an attack from a malicious CA to circumvent certain checks.

  Invalid certificate policies in leaf certificates are silently ignored by
  OpenSSL an…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-295
  - CWE-295
vendor: openssl
product: openssl
affected:
  - 'openssl >= 1.0.2, < 1.0.2zh'
  - 'openssl >= 1.1.1, < 1.1.1u'
  - 'openssl >= 3.0.0, < 3.0.9'
  - 'openssl >= 3.1.0, < 3.1.1'
patched:
  - openssl 3.1.1
published: '2023-03-28'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T20:17:23.747'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-0465'
references:
  - url: >-
      https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=10325176f3d3e98c6e2b3bf5ab1e3b334de6947a
    label: openssl-security@openssl.org
  - url: >-
      https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1dd43e0709fece299b15208f36cc7c76209ba0bb
    label: openssl-security@openssl.org
  - url: >-
      https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=b013765abfa80036dc779dd0e50602c57bb3bf95
    label: openssl-security@openssl.org
  - url: >-
      https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=facfb1ab745646e97a1920977ae4a9965ea61d5c
    label: openssl-security@openssl.org
  - url: 'https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html'
    label: openssl-security@openssl.org
  - url: 'https://security.gentoo.org/glsa/202402-08'
    label: openssl-security@openssl.org
  - url: 'https://security.netapp.com/advisory/ntap-20230414-0001/'
    label: openssl-security@openssl.org
  - url: 'https://www.debian.org/security/2023/dsa-5417'
    label: openssl-security@openssl.org
  - url: 'https://www.openssl.org/news/secadv/20230328.txt'
    label: openssl-security@openssl.org
  - url: >-
      https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=10325176f3d3e98c6e2b3bf5ab1e3b334de6947a
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1dd43e0709fece299b15208f36cc7c76209ba0bb
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=b013765abfa80036dc779dd0e50602c57bb3bf95
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=facfb1ab745646e97a1920977ae4a9965ea61d5c
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.gentoo.org/glsa/202402-08'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20230414-0001/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.debian.org/security/2023/dsa-5417'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.openssl.org/news/secadv/20230328.txt'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-337522.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-341067.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-556635.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-625862.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-769027.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-794697.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-879734.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
epss: 0.01583
epssPercentile: 0.75055
ingestedAt: '2026-10-14T20:53:12.258Z'
---

## Overview

Applications that use a non-default option when verifying certificates may be
vulnerable to an attack from a malicious CA to circumvent certain checks.

Invalid certificate policies in leaf certificates are silently ignored by
OpenSSL and other certificate policy checks are skipped for that certificate.
A malicious CA could use this to deliberately assert invalid certificate policies
in order to circumvent policy checking on the certificate altogether.

Policy processing is disabled by default but can be enabled by passing
the `-policy' argument to the command line utilities or by calling the
`X509_VERIFY_PARAM_set1_policies()' function.

## Affected

- `openssl >= 1.0.2, < 1.0.2zh`
- `openssl >= 1.1.1, < 1.1.1u`
- `openssl >= 3.0.0, < 3.0.9`
- `openssl >= 3.1.0, < 3.1.1`

## Remediation

Upgrade past the affected range:

- `openssl 3.1.1`