CVE-2017-8301

Name: CVE-2017-8301
Creator: NVD / NIST
Published: 2017-04-27T17:59:00.187+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.01%

Last modified Jun 17, 2026

CVE-2017-8301 is a vulnerability of currently unknown severity. LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied upon for a later check of a verification result, in a use case where a user-provided verification callback returns 1, as demonstrated by acceptance of invalid certificates by nginx.. EPSS estimates a 1.01% chance of exploitation in the next 30 days.

Description

LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied upon for a later check of a verification result, in a use case where a user-provided verification callback returns 1, as demonstrated by acceptance of invalid certificates by nginx.

Metrics

EPSS Probability

1.01%

58.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-295

Affected Software

Vendor	Product	Versions
Openbsd	Libressl	2.5.1
Openbsd	Libressl	2.5.2
Openbsd	Libressl	2.5.3

References

http://seclists.org/oss-sec/2017/q2/145Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/98076Third Party Advisory, VDB Entry
https://github.com/libressl-portable/portable/issues/307Issue Tracking, Patch, Third Party Advisory
https://trac.nginx.org/nginx/ticket/1257Issue Tracking, Patch, Third Party Advisory
http://seclists.org/oss-sec/2017/q2/145Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/98076Third Party Advisory, VDB Entry
https://github.com/libressl-portable/portable/issues/307Issue Tracking, Patch, Third Party Advisory
https://trac.nginx.org/nginx/ticket/1257Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Apr 27, 2017
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2017-8301?

How severe is CVE-2017-8301?

Severity scoring for CVE-2017-8301 is pending analysis. The EPSS model estimates a 1.01% probability of exploitation in the next 30 days.

How do I fix CVE-2017-8301?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-8301?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST