CVE-2023-41991

Опубликовано: 21 сент. 2023

Источник: nvd

CVSS3: 5.5

EPSS Низкий

Описание

A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

Ссылки

https://support.apple.com/en-us/HT213927
Vendor Advisory
https://support.apple.com/en-us/HT213931
Vendor Advisory
https://support.apple.com/en-us/HT213927
Vendor Advisory
https://support.apple.com/en-us/HT213931
Vendor Advisory
https://support.apple.com/kb/HT213927
Vendor Advisory
https://support.apple.com/kb/HT213931
Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41991
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

Версия до 16.7 (исключая)

cpe:2.3:o:apple:ipados:17.0:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

Версия до 16.7 (исключая)

cpe:2.3:o:apple:iphone_os:17.0:*:*:*:*:*:*:*

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Версия от 13.0 (включая) до 13.6 (исключая)

EPSS

Процентиль: 87%

0.0348

Низкий

5.5 Medium

CVSS3

Дефекты

CWE-295

Связанные уязвимости

GHSA-fj3m-2r8f-m4x9

CVSS3: 5.5

github

больше 2 лет назад

A certificate validation issue was addressed. This issue is fixed in iOS 16.7 and iPadOS 16.7, OS 17.0.1 and iPadOS 17.0.1, watchOS 9.6.3, macOS Ventura 13.6, watchOS 10.0.1. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

BDU:2023-06111

CVSS3: 5.5

fstec

больше 2 лет назад

Уязвимость компонента Security операционных систем iOS, watchOS, iPadOS и macOS, позволяющая нарушителю обойти проверку цифровой подписи

EPSS

Процентиль: 87%

0.0348

Низкий

5.5 Medium

CVSS3

Дефекты

CWE-295