CVE-2023-40012

HIGH EPSS 10.0%
Published Aug 9, 20232y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Aug 9, 2023 2y ago
Last Modified Jun 17, 2026 2w ago

Description

uthenticode is a small cross-platform library for partially verifying Authenticode digital signatures. Versions of uthenticode prior to the 2.x series did not check Extended Key Usages in certificates, in violation of the Authenticode X.509 certificate profile. As a result, a malicious user could produce a "signed" PE file that uthenticode would verify and consider valid using an X.509 certificate that isn't entitled to produce code signatures (e.g., a SSL certificate). By design, uthenticode does not perform full-chain validation. However, the absence of EKU validation was an unintended oversight. The 2.0.0 release series includes EKU checks. There are no workarounds to this vulnerability.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
10.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-325
CWE-347

Affected Products 1

VendorProductVersionRange
trailofbitsuthenticode* <2.0.0

References 3

  • github.com https://github.com/trailofbits/uthenticode/commit/caeb1eb62412605f71bd96ce9bb9420644b6db53
    Patch
  • github.com https://github.com/trailofbits/uthenticode/pull/78
    Patch
  • github.com https://github.com/trailofbits/uthenticode/security/advisories/GHSA-gm2f-j4rj-6xqj
    Vendor Advisory

Remediation

  • github.com https://github.com/trailofbits/uthenticode/commit/caeb1eb62412605f71bd96ce9bb9420644b6db53
    Patch
  • github.com https://github.com/trailofbits/uthenticode/pull/78
    Patch