OpenSSL released a security advisory regarding CVE-2015-1793, a bug in the implementation of the certificate verification process:
… from version 1.0.1n and 1.0.2b) will attempt to find an alternative certificate chain if the first attempt to build such a chain fails. An error in the implementation of this logic can mean that an attacker could cause certain checks on untrusted certificates to be bypassed, such as the CA flag, enabling them to use a valid leaf certificate to act as a CA and “issue” an invalid certificate.
This largely impacts clients which verify certificates and servers leveraging client authentication. Additionally, most major browsers, IE, FF and Chrome, do not utilize OpenSSL as the client for TLS connections. Thus while this is a high severity vulnerability it also carries a low impact. Due to the nature of this particular issue implementing a test in Sentinel is unnecessary.
If you have any questions please contact WhiteHat Customer Support at firstname.lastname@example.org.
The following OpenSSL versions are affected:
* 1.0.2c, 1.0.2b
* 1.0.1n, 1.0.1o
The recommended solution is to update the affected version of OpenSSL:
* OpenSSL 1.0.2b/1.0.2c users should upgrade to 1.0.2d
* OpenSSL 1.0.1n/1.0.1o users should upgrade to 1.0.1p