CVSS 3.0
6.5 mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NCVE-2015-1793
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.
Severity
- EPSS
- 58% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWE
- CWE-254
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openssl:openssl
- oracle:jd_edwards_enterpriseone_tools
- oracle:opus_10g_ethernet_switch_family
- oracle:supply_chain_products_suite
References
- http://fortiguard.com/advisory/2015-07-09-cve-2015-1793-openssl-alternative-chains-certificate-forgery
- http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10694
- http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161747.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161782.html