CVE-2023-6056 — Insecure Trust of Self-Signed Certificates in Bitdefender Total Security HTTPS Scanning (VA-11164)

CVE-2023-6056

Insecure Trust of Self-Signed Certificates in Bitdefender Total Security HTTPS Scanning (VA-11164) PUBLISHED

Description (CNA)

A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of self-signed certificates. The product is found to trust certificates signed with the RIPEMD-160 hashing algorithm without proper validation, allowing an attacker to establish MITM SSL connections to arbitrary sites.

Affected (CNA)

Vendor / product	Versions
BItdefender / Total Security	affected 0 before 27.0.25.115

CWE

CWE-295

References

https://www.bitdefender.com/support/security-advisories/insecure-trust-of-self-signed-certificates-in-bitdefender-total-security-https-scanning-va-11164/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.