LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied upon for a later check of a verification result, in a use case where a user-provided verification callback returns 1, as demonstrated by acceptance of invalid certificates by nginx.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied upon for a
    later check of a verification result, in a use case where a user-provided verification callback returns 1,
    as demonstrated by acceptance of invalid certificates by nginx. (CVE-2017-8301)

Jakub Jirutka reports :

LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied upon for a later check of a verification result, in a use case where a user-provided verification callback returns 1, as demonstrated by acceptance of invalid certificates by nginx.

ID	Name	Product	Family	Severity
405265	Alpine: multiple libressl packages: security update to 2.5.3-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
405265	Alpine: multiple libressl packages: security update to 2.5.3-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
400889	Alpine: multiple libressl packages: security update to 2.5.3-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
400889	Alpine: multiple libressl packages: security update to 2.5.3-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
99749	FreeBSD : LibreSSL -- TLS verification vulnerability (24673ed7-2bf3-11e7-b291-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2017-8301

medium

Tenable Plugins

medium

medium

medium

medium

medium