CVE-2017-8301

LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied upon for a later check of a verification result, in a use case…

published April 27, 2017

CVSS
—
EPSS
1%
Percentile
63.5
In the wild
Unconfirmed
What it is

LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied upon for a later check of a verification result, in a use case where a user-provided verification callback returns 1, as demonstrated by acceptance of invalid certificates by nginx.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01041 · 63.5th percentile
Published
2017-04-27T17:00Z
EPSS history
Timeline
  • 27 APR 17:00Z
    LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied upon for a later check of a verification result, in a use case…
    cvelistv5