CVE-2023-41991

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-41991
A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://support.apple.com/en-us/HT213927 Release Notes Vendor Advisory
https://support.apple.com/en-us/HT213931 Release Notes Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:17.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:17.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
History

10 Jan 2024, 22:15

Type Values Removed Values Added
References
  • {'url': 'http://seclists.org/fulldisclosure/2023/Oct/4', 'source': 'product-security@apple.com'}
  • {'url': 'http://seclists.org/fulldisclosure/2023/Oct/5', 'tags': ['Mailing List', 'Third Party Advisory'], 'source': 'product-security@apple.com'}

07 Nov 2023, 04:21

Type Values Removed Values Added
References
  • () http://seclists.org/fulldisclosure/2023/Oct/4 -

24 Oct 2023, 12:56

Type Values Removed Values Added
CPE cpe:2.3:o:apple:ipados:17.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:17.0:*:*:*:*:*:*:*

12 Oct 2023, 02:45

Type Values Removed Values Added
References (MISC) https://support.apple.com/en-us/HT213931 - Vendor Advisory (MISC) https://support.apple.com/en-us/HT213931 - Release Notes, Vendor Advisory
References (MISC) http://seclists.org/fulldisclosure/2023/Oct/5 - (MISC) http://seclists.org/fulldisclosure/2023/Oct/5 - Mailing List, Third Party Advisory
References (MISC) https://support.apple.com/en-us/HT213927 - Vendor Advisory (MISC) https://support.apple.com/en-us/HT213927 - Release Notes, Vendor Advisory
First Time Apple ipados
CPE cpe:2.3:o:apple:iphone_os:17.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:10.0.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipad_os:17.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipad_os:*:*:*:*:*:*:*:*		 cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

03 Oct 2023, 06:15

Type Values Removed Values Added
References
  • (MISC) http://seclists.org/fulldisclosure/2023/Oct/5 -

27 Sep 2023, 15:19

Type Values Removed Values Added
Summary A certificate validation issue was addressed. This issue is fixed in iOS 16.7 and iPadOS 16.7, OS 17.0.1 and iPadOS 17.0.1, watchOS 9.6.3, macOS Ventura 13.6, watchOS 10.0.1. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7. A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
References
  • {'url': 'https://support.apple.com/en-us/HT213926', 'name': 'https://support.apple.com/en-us/HT213926', 'tags': ['Vendor Advisory'], 'refsource': 'MISC'}
  • {'url': 'http://seclists.org/fulldisclosure/2023/Sep/17', 'name': 'http://seclists.org/fulldisclosure/2023/Sep/17', 'tags': ['Third Party Advisory'], 'refsource': 'MISC'}
  • {'url': 'https://support.apple.com/kb/HT213926', 'name': 'https://support.apple.com/kb/HT213926', 'tags': ['Vendor Advisory'], 'refsource': 'MISC'}
  • {'url': 'http://seclists.org/fulldisclosure/2023/Sep/15', 'name': 'http://seclists.org/fulldisclosure/2023/Sep/15', 'tags': ['Third Party Advisory'], 'refsource': 'MISC'}
  • {'url': 'http://seclists.org/fulldisclosure/2023/Sep/19', 'name': 'http://seclists.org/fulldisclosure/2023/Sep/19', 'tags': ['Third Party Advisory'], 'refsource': 'MISC'}
  • {'url': 'http://seclists.org/fulldisclosure/2023/Sep/14', 'name': 'http://seclists.org/fulldisclosure/2023/Sep/14', 'tags': ['Third Party Advisory'], 'refsource': 'MISC'}
  • {'url': 'https://support.apple.com/en-us/HT213928', 'name': 'https://support.apple.com/en-us/HT213928', 'tags': ['Vendor Advisory'], 'refsource': 'MISC'}
  • {'url': 'https://support.apple.com/en-us/HT213929', 'name': 'https://support.apple.com/en-us/HT213929', 'tags': ['Vendor Advisory'], 'refsource': 'MISC'}
  • {'url': 'http://seclists.org/fulldisclosure/2023/Sep/16', 'name': 'http://seclists.org/fulldisclosure/2023/Sep/16', 'tags': ['Third Party Advisory'], 'refsource': 'MISC'}

25 Sep 2023, 16:17

Type Values Removed Values Added
CWE CWE-295
CPE cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:10.0.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipad_os:17.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:17.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipad_os:*:*:*:*:*:*:*:*
References (MISC) https://support.apple.com/en-us/HT213927 - (MISC) https://support.apple.com/en-us/HT213927 - Vendor Advisory
References (MISC) https://support.apple.com/en-us/HT213926 - (MISC) https://support.apple.com/en-us/HT213926 - Vendor Advisory
References (MISC) http://seclists.org/fulldisclosure/2023/Sep/17 - (MISC) http://seclists.org/fulldisclosure/2023/Sep/17 - Third Party Advisory
References (MISC) https://support.apple.com/kb/HT213926 - (MISC) https://support.apple.com/kb/HT213926 - Vendor Advisory
References (MISC) http://seclists.org/fulldisclosure/2023/Sep/15 - (MISC) http://seclists.org/fulldisclosure/2023/Sep/15 - Third Party Advisory
References (MISC) http://seclists.org/fulldisclosure/2023/Sep/19 - (MISC) http://seclists.org/fulldisclosure/2023/Sep/19 - Third Party Advisory
References (MISC) http://seclists.org/fulldisclosure/2023/Sep/14 - (MISC) http://seclists.org/fulldisclosure/2023/Sep/14 - Third Party Advisory
References (MISC) https://support.apple.com/en-us/HT213928 - (MISC) https://support.apple.com/en-us/HT213928 - Vendor Advisory
References (MISC) https://support.apple.com/en-us/HT213931 - (MISC) https://support.apple.com/en-us/HT213931 - Vendor Advisory
References (MISC) https://support.apple.com/en-us/HT213929 - (MISC) https://support.apple.com/en-us/HT213929 - Vendor Advisory
References (MISC) http://seclists.org/fulldisclosure/2023/Sep/16 - (MISC) http://seclists.org/fulldisclosure/2023/Sep/16 - Third Party Advisory
First Time Apple macos
Apple
Apple watchos
Apple iphone Os
Apple ipad Os
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

23 Sep 2023, 03:15

Type Values Removed Values Added
References
  • (MISC) http://seclists.org/fulldisclosure/2023/Sep/17 -
  • (MISC) http://seclists.org/fulldisclosure/2023/Sep/15 -
  • (MISC) http://seclists.org/fulldisclosure/2023/Sep/19 -
  • (MISC) http://seclists.org/fulldisclosure/2023/Sep/14 -
  • (MISC) http://seclists.org/fulldisclosure/2023/Sep/16 -

21 Sep 2023, 20:15

Type Values Removed Values Added
References
  • (MISC) https://support.apple.com/kb/HT213926 -

21 Sep 2023, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-09-21 19:15

Updated : 2024-01-10 22:15

NVD link : CVE-2023-41991

Mitre link : CVE-2023-41991

CVE.ORG link : CVE-2023-41991

JSON object : View

Products Affected

apple

  • iphone_os
  • macos
  • ipados
CWE
CWE-295

Improper Certificate Validation