| # OpenSSL Advisory: March 22nd, 2023 |
| |
| OpenSSL have published a [security advisory](https://openssl-library.org/news/secadv/20230322.txt). Here's how it affects BoringSSL: |
| |
| CVE | Summary | [Severity] in OpenSSL | Impact to BoringSSL |
| ----|---------|-----------------------|--------------------- |
| CVE-2023-0464 | Excessive Resource Usage Verifying X.509 Policy Constraints | Low | Fixed [January 2023](https://boringssl.googlesource.com/boringssl/+/029d0e77fb64625469cc02c8df26767c72081dfd) |
| |
| [Severity]: https://openssl-library.org/policies/general/security-policy/index.html#issue-severity |
| |
| ## CVE-2023-0464 |
| |
| We discovered this bug while working on the X.509 code in BoringSSL and Chromium. It is discussed in detail in this [IETF draft](https://datatracker.ietf.org/doc/draft-davidben-x509-policy-graph/) we published ([latest snapshot as of writing](https://www.ietf.org/archive/id/draft-davidben-x509-policy-graph-00.html)). Rather than capping the nodes, BoringSSL [implements](https://boringssl.googlesource.com/boringssl/+/029d0e77fb64625469cc02c8df26767c72081dfd) the draft's more efficient DAG strategy. Callers that enable X.509 policy validation should update to commit [ba68ca070ca939](https://boringssl.googlesource.com/boringssl/+/ba68ca070ca939bc2d6b8f07bd64909bd90b25a5) (January 20, 2023) or later. |
| |
| Policy checking is enabled if one of the following APIs is used: |
| * `X509_VERIFY_PARAM_set1_policies` |
| * `X509_V_FLAG_POLICY_CHECK` |
| * `X509_V_FLAG_EXPLICIT_POLICY` |
| * `X509_V_FLAG_INHIBIT_ANY` |
| * `X509_V_FLAG_INHIBIT_MAP` |
| |
| Future revisions of BoringSSL may enable it unconditionally to address some [issues with critical extensions](https://bugs.chromium.org/p/boringssl/issues/detail?id=557), but only with the new, efficient implementation. |
| |
| *January 27th, 2026 addendum: Policy validation was enabled unconditionally in BoringSSL shortly after this advisory was published, on [March 30th, 2023](https://boringssl.googlesource.com/boringssl/+/28226f584e8fb65eb8730721dcb5001f2a072efc). Our improved policy validation algorithm was published as [RFC 9618](https://www.rfc-editor.org/rfc/rfc9618.html).* |
