OpenSSL: Alternate chains certificate forgery

OpenSSL: Alternate chains certificate forgery Certain checks on untrusted certificates can be bypassed. openssl 2015-07-10 2016-02-26 554172 remote 1.0.1p 0.9.8z_p6 0.9.8z_p7 0.9.8z_p8 0.9.8z_p9 0.9.8z_p10 0.9.8z_p11 0.9.8z_p12 0.9.8z_p13 0.9.8z_p14 0.9.8z_p15 1.0.1p

OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.

During certificate verification, OpenSSL attempts to find an alternative certificate chain if the first attempt to build such a chain fails.

A remote attacker could cause certain checks on untrusted certificates to be bypassed, such as the CA flag, enabling them to use a valid leaf certificate to act as a CA and “issue” an invalid certificate.

There is no known workaround at this time.

All OpenSSL users should upgrade to the latest version:


      # emerge --sync
      # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.1p"

CVE-2015-1793 keytoaster keytoaster