cve/2023/CVE-2023-0464.md

### [CVE-2023-0464](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0464)
![](https://img.shields.io/static/v1?label=Product&message=OpenSSL&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=3.1.0%3C%203.1.1%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=inefficient%20algorithmic%20complexity&color=brighgreen)

### Description

A security vulnerability has been identified in all supported versionsof OpenSSL related to the verification of X.509 certificate chainsthat include policy constraints.  Attackers may be able to exploit thisvulnerability by creating a malicious certificate chain that triggersexponential use of computational resources, leading to a denial-of-service(DoS) attack on affected systems.Policy processing is disabled by default but can be enabled by passingthe `-policy' argument to the command line utilities or by calling the`X509_VERIFY_PARAM_set1_policies()' function.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/1g-v/DevSec_Docker_lab
- https://github.com/ARPSyndicate/cvemon
- https://github.com/L-ivan7/-.-DevSec_Docker
- https://github.com/Trinadh465/Openssl_1.1.1g_CVE-2023-0464
- https://github.com/chnzzh/OpenSSL-CVE-lib
- https://github.com/cloudogu/ces-build-lib
- https://github.com/fkie-cad/nvd-json-data-feeds
- https://github.com/nomi-sec/PoC-in-GitHub
- https://github.com/ortelius/ms-textfile-crud
- https://github.com/seal-community/patches