# OpenSSL Advisory: March 28th, 2023

OpenSSL have published a [security advisory](https://openssl-library.org/news/secadv/20230328.txt). Here's how it affects BoringSSL:

CVE | Summary | [Severity] in OpenSSL | Impact to BoringSSL
----|---------|-----------------------|---------------------
CVE-2023-0465 | Invalid certificate policies in leaf certificates are silently ignored | Low | Fixed [December 2022](https://boringssl.googlesource.com/boringssl/+/d1b20a9580aebb6fbb0b1b2408cf1221d83afb71)
CVE-2023-0466 | Certificate policy check not enabled | Low | See discussion below

[Severity]: https://openssl-library.org/policies/general/security-policy/index.html#issue-severity

## CVE-2023-0465

We discovered this issue while working on the X.509 implementation in BoringSSL. This was fixed in BoringSSL on [December 20, 2022](https://boringssl.googlesource.com/boringssl/+/d1b20a9580aebb6fbb0b1b2408cf1221d83afb71). Applications that enable policy validation should update to `d1b20a9580aeb` or later.

Policy validation is enabled if one of the following APIs is used:

* `X509_VERIFY_PARAM_set1_policies`
* `X509_V_FLAG_POLICY_CHECK`
* `X509_V_FLAG_EXPLICIT_POLICY`
* `X509_V_FLAG_INHIBIT_ANY`
* `X509_V_FLAG_INHIBIT_MAP`

## CVE-2023-0466

We discovered this issue while working on the X.509 implementation in BoringSSL. The `X509_VERIFY_PARAM_add0_policy` function, contrary to its documentation in OpenSSL, does not implicitly enable policy validation. OpenSSL opted to leave the function’s behavior unchanged and update the documentation.

Applications that call `X509_VERIFY_PARAM_add0_policy` and do not use one of the above APIs should explicitly call `X509_VERIFY_PARAM_set_flags` with `X509_V_FLAG_POLICY_CHECK` if the intent was to enable policy validation.

Future revisions of BoringSSL may enable policy validation unconditionally to address some [issues with critical extensions](https://bugs.chromium.org/p/boringssl/issues/detail?id=557), which will make this moot.

*January 27th, 2026 addendum: Policy validation was enabled unconditionally in BoringSSL shortly after this advisory was published, on [March 30th, 2023](https://boringssl.googlesource.com/boringssl/+/28226f584e8fb65eb8730721dcb5001f2a072efc).*