6.5
CVE-2015-1793
- EPSS 82.59%
- Veröffentlicht 09.07.2015 19:17:00
- Zuletzt bearbeitet 12.04.2025 10:46:40
- Quelle secalert@redhat.com
- Teams Watchlist Login
- Unerledigt Login
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Oracle ≫ Supply Chain Products Suite Version6.1.2.2
Oracle ≫ Supply Chain Products Suite Version6.1.3.0
Oracle ≫ Supply Chain Products Suite Version6.2.0
Oracle ≫ Jd Edwards Enterpriseone Tools Version9.1
Oracle ≫ Jd Edwards Enterpriseone Tools Version9.2
Oracle ≫ Opus 10g Ethernet Switch Family Version <= 2.0.0.6
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 82.59% | 0.992 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.5 | 3.9 | 2.5 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
|
| nvd@nist.gov | 6.4 | 10 | 4.9 |
AV:N/AC:L/Au:N/C:P/I:P/A:N
|