CVE-2023-0464

Description

A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
openssl	26.10 stonking	Fixed in 3.0.8-1ubuntu2
	26.04 LTS resolute	Fixed in 3.0.8-1ubuntu2
	25.10 questing	Fixed in 3.0.8-1ubuntu2
	25.04 plucky	Fixed in 3.0.8-1ubuntu2
	24.10 oracular	Fixed in 3.0.8-1ubuntu2
	24.04 LTS noble	Fixed in 3.0.8-1ubuntu2
	23.10 mantic	Fixed in 3.0.8-1ubuntu2
	23.04 lunar	Fixed in 3.0.8-1ubuntu1.1
	22.10 kinetic	Fixed in 3.0.5-2ubuntu2.2
	22.04 LTS jammy	Fixed in 3.0.2-0ubuntu1.9
	20.04 LTS focal	Fixed in 1.1.1f-1ubuntu2.18
	18.04 LTS bionic	Fixed in 1.1.1-1ubuntu2.1~18.04.22
	16.04 LTS xenial	Fixed in 1.0.2g-1ubuntu4.20+esm7
	14.04 LTS trusty	Fixed in 1.0.1f-1ubuntu2.27+esm7
nodejs	26.10 stonking	Not affected
	26.04 LTS resolute	Not affected
	25.10 questing	Not affected
	25.04 plucky	Not affected
	24.10 oracular	Not affected
	24.04 LTS noble	Not affected
	23.10 mantic	Not affected
	23.04 lunar	Not affected
	22.10 kinetic	Not affected
	22.04 LTS jammy	Vulnerable
	20.04 LTS focal	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected
edk2	26.10 stonking	Not affected
	26.04 LTS resolute	Not affected
	25.10 questing	Not affected
	25.04 plucky	Not affected
	24.10 oracular	Not affected
	24.04 LTS noble	Not affected
	23.10 mantic	Ignored end of life, was needed
	23.04 lunar	Ignored end of life, was needs-triage
	22.10 kinetic	Ignored end of life, was needs-triage
	22.04 LTS jammy	Fixed in 2022.02-3ubuntu0.22.04.4
	20.04 LTS focal	Vulnerable
	18.04 LTS bionic	Needs evaluation
	16.04 LTS xenial	Needs evaluation
	14.04 LTS trusty	Ignored end of standard support
openssl1.0	22.10 kinetic	Not in release
	22.04 LTS jammy	Not in release
	20.04 LTS focal	Not in release
	18.04 LTS bionic	Fixed in 1.0.2n-1ubuntu5.12
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro 30-day free trial

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
openssl	Upstream: https://git.openssl.org/?p=openssl.git;a=commit;h=879f7080d7e141f415c79eaa3a8ac4a3dad0348b Upstream: https://git.openssl.org/?p=openssl.git;a=commit;h=959c59c7a0164117e7f8366466a32bb1f8d77ff1

Severity score breakdown

CVSS version: CVSS v3.0

Base score 7.5 · High

Base metrics

Parameter	Value
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality impact	None
Integrity impact	None
Availability impact	High

Scores

Parameter	Value
Base score	7.5 · High
Exploitability score	-
Impact score	-

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Related Ubuntu Security Notices (USN)

USN-6039-1
OpenSSL vulnerabilities
25 April 2023

USN-7894-1
EDK II vulnerabilities
26 November 2025

Cvss 3 Severity Score