LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied upon for a later check of a verification result, in a use case where a user-provided verification callback returns 1, as demonstrated by acceptance of invalid certificates by nginx.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2017-04-27T17:00:00

Updated: 2024-08-05T16:34:22.062Z

Reserved: 2017-04-27T00:00:00

Link: CVE-2017-8301

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2017-04-27T17:59:00.187

Modified: 2024-11-21T03:33:43.680

Link: CVE-2017-8301

cve-icon Redhat

No data.