Every CVE Search/ Get API key

CVE-2015-1793

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1...

6.5 MediumPublic exploitFix available

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

58.2%Down 20.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.5

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.

Record
CVE-2015-1793
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 2.0
6.4 MediumAV:N/AC:L/Au:N/C:P/I:P/A:N
Weakness
CWE-254
Updated
2026-11-02
CVE List No score

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.

Record
CVE-2015-1793
Updated
2026-11-02
EUVDEUVD-2015-1919 No score

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.

Record
EUVD-2015-1919
Updated
2026-11-03
GitHub AdvisoriesGHSA-4j29-v246-6w5w 6.5

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1...

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.

Record
GHSA-4j29-v246-6w5w
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVBELL-CVE-2015-1793 6.5

CVE-2015-1793 does not affect BellSoft software

Record
BELL-CVE-2015-1793
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSV 6.5

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.

Record
CVE-2015-1793
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2015-1793 6.5

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.

Record
DEBIAN-CVE-2015-1793
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2015-1793 6.5

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.

Record
UBUNTU-CVE-2015-1793
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVMGASA-2015-0274 No score

Updated openssl package fixes security vulnerability

During certificate verification, OpenSSL (starting from version 1.0.1n and 1.0.2b) will attempt to find an alternative certificate chain if the first attempt to build such a chain fails. An error in the implementation of this logic can mean that an attacker could cause certain checks on untrusted certificates to be bypassed, such as the CA flag, enabling them to use a valid leaf certificate to act as a CA and "issue" an invalid certificate (CVE-2015-1793).

Record
MGASA-2015-0274
Updated
2026-11-02
OSVopenSUSE-SU-2024:10200-1 No score

libmysql56client18-32bit-5.6.34-1.1 on GA media

These are all security issues fixed in the libmysql56client18-32bit-5.6.34-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10200-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10271-1 No score

libopenssl-devel-1.0.2j-2.2 on GA media

These are all security issues fixed in the libopenssl-devel-1.0.2j-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10271-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10529-1 No score

libopenssl1_0_0-steam-1.0.2h-4.1 on GA media

These are all security issues fixed in the libopenssl1_0_0-steam-1.0.2h-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10529-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11127-1 No score

libopenssl-1_1-devel-1.1.1l-1.2 on GA media

These are all security issues fixed in the libopenssl-1_1-devel-1.1.1l-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11127-1
Updated
2026-11-02
OSVSUSE-SU-2015:2303-1 No score

Security update for mysql

The mysql package was updated to version 5.5.46 to fixs several security and non security issues.

  • bnc#951391: update to version 5.5.46
    • changes: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-46.html
    • fixed CVEs: CVE-2015-1793, CVE-2015-0286, CVE-2015-0288, CVE-2015-1789, CVE-2015-4730, CVE-2015-4766, CVE-2015-4792, CVE-2015-4800, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4833, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4862, CVE-2015-4864, CVE-2015-4866, CVE-2015-4870, CVE-2015-4879, CVE-2015-4890, CVE-2015-4895, CVE-2015-4904, CVE-2015-4905, CVE-2015-4910, CVE-2015-4913
  • bnc#952196: Fixed a build error for ppc*, s390* and ia64 architectures.
Record
SUSE-SU-2015:2303-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openssl
Debian:12
 before 1.0.2d-1
1.0.2d-1
openssl
Debian:13
 before 1.0.2d-1
1.0.2d-1
openssl
Debian:14
 before 1.0.2d-1
1.0.2d-1
openssl
Mageia:4
 before 1.0.1p-1.mga4
1.0.1p-1.mga4
openssl
Mageia:5
 before 1.0.2d-1.mga5
1.0.2d-1.mga5
mysql
SUSE:Linux Enterprise Software Development Kit 11 SP3
From an advisory covering 29 CVEs
 before 5.5.46-0.14.1
5.5.46-0.14.1
mysql
SUSE:Linux Enterprise Software Development Kit 11 SP4
From an advisory covering 29 CVEs
 before 5.5.46-0.14.1
5.5.46-0.14.1
mysql
SUSE:Linux Enterprise Desktop 11 SP3
From an advisory covering 29 CVEs
 before 5.5.46-0.14.1
5.5.46-0.14.1
mysql
SUSE:Linux Enterprise Desktop 11 SP4
From an advisory covering 29 CVEs
 before 5.5.46-0.14.1
5.5.46-0.14.1
mysql
SUSE:Linux Enterprise Server 11 SP3
From an advisory covering 29 CVEs
 before 5.5.46-0.14.1
5.5.46-0.14.1
Show 5 moreShow less
Affected packages
PackageAffectedFixed
mysql
SUSE:Linux Enterprise Server 11 SP3-TERADATA
From an advisory covering 29 CVEs
 before 5.5.46-0.14.1
5.5.46-0.14.1
mysql
SUSE:Linux Enterprise Server for SAP Applications 11 SP3
From an advisory covering 29 CVEs
 before 5.5.46-0.14.1
5.5.46-0.14.1
mysql
SUSE:Linux Enterprise Server 11 SP4
From an advisory covering 29 CVEs
 before 5.5.46-0.14.1
5.5.46-0.14.1
mysql
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
From an advisory covering 29 CVEs
 before 5.5.46-0.14.1
5.5.46-0.14.1
openssl-1_1
openSUSE:Tumbleweed
From an advisory covering 136 CVEs
 before 1.1.1l-1.2
1.1.1l-1.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBOpenSSL - Alternative Chains Certificate Forgery2015-11-05
MetasploitOpenSSL Alternative Chains Certificate Forgery MITM Proxy2015-07-09

History

History
RecordedChangedSources
affected, facts
affected
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-1793 is a medium vulnerability (CVSS 6.5) in Openssl, published July 9, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 58.2%, the 99th percentile. Fixed in openssl 1.0.2d-1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 92 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open