{
  "document": {
    "aggregate_severity": {
      "text": "Medium"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/ubuntu20.04els/vex/2023/cve-2023-0466-els_os-ubuntu20_04els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-04-24T21:59:53Z",
      "generator": {
        "date": "2026-04-24T21:59:53Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2023-0466-ELS_OS-UBUNTU20.04ELS",
      "initial_release_date": "2023-03-28T15:15:00Z",
      "revision_history": [
        {
          "date": "2023-03-28T15:15:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-20T12:35:50Z",
          "number": "2",
          "summary": "Official Publication"
        },
        {
          "date": "2026-04-24T21:59:53Z",
          "number": "3",
          "summary": "Update document"
        }
      ],
      "status": "final",
      "version": "3"
    },
    "title": "Security update on CVE-2023-0466"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Ubuntu 20.04",
                "product": {
                  "name": "Ubuntu 20.04",
                  "product_id": "Ubuntu-20",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Ubuntu"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libssl-dev-0:1.1.1f-1ubuntu2.24.amd64",
                "product": {
                  "name": "libssl-dev-0:1.1.1f-1ubuntu2.24.amd64",
                  "product_id": "libssl-dev-0:1.1.1f-1ubuntu2.24.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/ubuntu/libssl-dev@1.1.1f-1ubuntu2.24?arch=amd64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Canonical Ltd."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libssl-dev-0:1.1.1f-1ubuntu2.24+tuxcare.els2.amd64",
                "product": {
                  "name": "libssl-dev-0:1.1.1f-1ubuntu2.24+tuxcare.els2.amd64",
                  "product_id": "libssl-dev-0:1.1.1f-1ubuntu2.24+tuxcare.els2.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/libssl-dev@1.1.1f-1ubuntu2.24%2Btuxcare.els2?arch=amd64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libssl-dev-0:1.1.1f-1ubuntu2.24+tuxcare.els2.amd64 as a component of Ubuntu 20.04",
          "product_id": "Ubuntu-20:libssl-dev-0:1.1.1f-1ubuntu2.24+tuxcare.els2.amd64"
        },
        "product_reference": "libssl-dev-0:1.1.1f-1ubuntu2.24+tuxcare.els2.amd64",
        "relates_to_product_reference": "Ubuntu-20"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libssl-dev-0:1.1.1f-1ubuntu2.24.amd64 as a component of Ubuntu 20.04",
          "product_id": "Ubuntu-20:libssl-dev-0:1.1.1f-1ubuntu2.24.amd64"
        },
        "product_reference": "libssl-dev-0:1.1.1f-1ubuntu2.24.amd64",
        "relates_to_product_reference": "Ubuntu-20"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-0466",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "The function X509_VERIFY_PARAM_add0_policy() is documented to\nimplicitly enable the certificate policy check when doing certificate\nverification. However the implementation of the function does not\nenable the check which allows certificates with invalid or incorrect\npolicies to pass the certificate verification.\n\nAs suddenly enabling the policy check could break existing deployments it was\ndecided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy()\nfunction.\n\nInstead the applications that require OpenSSL to perform certificate\npolicy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly\nenable the policy check by calling X509_VERIFY_PARAM_set_flags() with\nthe X509_V_FLAG_POLICY_CHECK flag argument.\n\nCertificate policy checks are disabled by default in OpenSSL and are not\ncommonly used by applications.",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "Ubuntu-20:libssl-dev-0:1.1.1f-1ubuntu2.24+tuxcare.els2.amd64",
          "Ubuntu-20:libssl-dev-0:1.1.1f-1ubuntu2.24.amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2023-0466"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2023/09/28/4",
          "url": "http://www.openwall.com/lists/oss-security/2023/09/28/4"
        },
        {
          "category": "external",
          "summary": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0d16b7e99aafc0b4a6d729eec65a411a7e025f0a",
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0d16b7e99aafc0b4a6d729eec65a411a7e025f0a"
        },
        {
          "category": "external",
          "summary": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=51e8a84ce742db0f6c70510d0159dad8f7825908",
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=51e8a84ce742db0f6c70510d0159dad8f7825908"
        },
        {
          "category": "external",
          "summary": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=73398dea26de9899fb4baa94098ad0a61f435c72",
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=73398dea26de9899fb4baa94098ad0a61f435c72"
        },
        {
          "category": "external",
          "summary": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc814a30fc4f0bc54fcea7d9a7462f5457aab061",
          "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc814a30fc4f0bc54fcea7d9a7462f5457aab061"
        },
        {
          "category": "external",
          "summary": "https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html",
          "url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html"
        },
        {
          "category": "external",
          "summary": "https://security.gentoo.org/glsa/202402-08",
          "url": "https://security.gentoo.org/glsa/202402-08"
        },
        {
          "category": "external",
          "summary": "https://security.netapp.com/advisory/ntap-20230414-0001/",
          "url": "https://security.netapp.com/advisory/ntap-20230414-0001/"
        },
        {
          "category": "external",
          "summary": "https://www.debian.org/security/2023/dsa-5417",
          "url": "https://www.debian.org/security/2023/dsa-5417"
        },
        {
          "category": "external",
          "summary": "https://www.openssl.org/news/secadv/20230328.txt",
          "url": "https://www.openssl.org/news/secadv/20230328.txt"
        }
      ],
      "release_date": "2023-03-28T15:15:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "details": "- OpenSSL disables certificate policy processing by default, and X509_VERIFY_PARAM_add0_policy() never enabled it, so systems that have not explicitly turned on policy checks are unaffected and standard TLS verification behavior is unchanged.  \n- Exploitation only matters if an application both supplies policy OIDs with this function and incorrectly assumes it enables enforcement; in that case the effect is limited to accepting a certificate with an incorrect policy OID, with no confidentiality loss, privilege escalation, or availability impact.  \n- Applications that require policy enforcement can explicitly enable it (e.g., X509_V_FLAG_POLICY_CHECK or X509_VERIFY_PARAM_set1_policies), making this a low‑priority issue for centrally managed server/VM deployments.",
          "product_ids": [
            "Ubuntu-20:libssl-dev-0:1.1.1f-1ubuntu2.24+tuxcare.els2.amd64",
            "Ubuntu-20:libssl-dev-0:1.1.1f-1ubuntu2.24.amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Ubuntu-20:libssl-dev-0:1.1.1f-1ubuntu2.24+tuxcare.els2.amd64",
            "Ubuntu-20:libssl-dev-0:1.1.1f-1ubuntu2.24.amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    }
  ]
}