# OpenSSL Advisory: March 22nd, 2023

OpenSSL have published a [security advisory](https://openssl-library.org/news/secadv/20230322.txt). Here's how it affects BoringSSL:

CVE | Summary | [Severity] in OpenSSL | Impact to BoringSSL
----|---------|-----------------------|---------------------
CVE-2023-0464 | Excessive Resource Usage Verifying X.509 Policy Constraints | Low | Fixed [January 2023](https://boringssl.googlesource.com/boringssl/+/029d0e77fb64625469cc02c8df26767c72081dfd)

[Severity]: https://openssl-library.org/policies/general/security-policy/index.html#issue-severity

## CVE-2023-0464

We discovered this bug while working on the X.509 code in BoringSSL and Chromium. It is discussed in detail in this [IETF draft](https://datatracker.ietf.org/doc/draft-davidben-x509-policy-graph/) we published ([latest snapshot as of writing](https://www.ietf.org/archive/id/draft-davidben-x509-policy-graph-00.html)). Rather than capping the nodes, BoringSSL [implements](https://boringssl.googlesource.com/boringssl/+/029d0e77fb64625469cc02c8df26767c72081dfd) the draft's more efficient DAG strategy. Callers that enable X.509 policy validation should update to commit [ba68ca070ca939](https://boringssl.googlesource.com/boringssl/+/ba68ca070ca939bc2d6b8f07bd64909bd90b25a5) (January 20, 2023) or later.

Policy checking is enabled if one of the following APIs is used:
* `X509_VERIFY_PARAM_set1_policies`
* `X509_V_FLAG_POLICY_CHECK`
* `X509_V_FLAG_EXPLICIT_POLICY`
* `X509_V_FLAG_INHIBIT_ANY`
* `X509_V_FLAG_INHIBIT_MAP`

Future revisions of BoringSSL may enable it unconditionally to address some [issues with critical extensions](https://bugs.chromium.org/p/boringssl/issues/detail?id=557), but only with the new, efficient implementation.

*January 27th, 2026 addendum: Policy validation was enabled unconditionally in BoringSSL shortly after this advisory was published, on [March 30th, 2023](https://boringssl.googlesource.com/boringssl/+/28226f584e8fb65eb8730721dcb5001f2a072efc). Our improved policy validation algorithm was published as [RFC 9618](https://www.rfc-editor.org/rfc/rfc9618.html).*