CVE-2023-40104

Summary

In ca-certificates, there is a possible way to read encrypted TLS data due to untrusted cryptographic certificates. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

Weaknesses

• Information disclosure

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

CVE Program Container

Additional References

• https://android.googlesource.com/platform/system/ca-certificates/+/91204b9fdbd77b3f27f94b73868607b2dccbfdad
• https://source.android.com/security/bulletin/2023-11-01

References

• https://android.googlesource.com/platform/system/ca-certificates/+/91204b9fdbd77b3f27f94b73868607b2dccbfdad
• https://source.android.com/security/bulletin/2023-11-01

• ←Previous
• Next→