CVE-2023-0466: 
Node.js vulnerability analysis and mitigation

CVE-2023-0466 affects OpenSSL versions 3.1, 3.0, 1.1.1, and 1.0.2. The vulnerability relates to the X509VERIFYPARAMadd0policy() function, which was documented to enable certificate policy checking during certificate verification, but the implementation does not actually enable this check. This allows certificates with invalid or incorrect policies to pass the certificate verification process (OpenSSL Advisory).

The vulnerability stems from a discrepancy between documentation and implementation in the X509VERIFYPARAMadd0policy() function. While the function was documented to implicitly enable certificate policy checking during verification, the actual implementation does not enable this check. Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications (OpenSSL Advisory).

The impact of this vulnerability is considered Low severity with a CVSS score of 5.3 (Medium). The vulnerability could potentially allow certificates with invalid or incorrect policies to pass the certificate verification process. However, since certificate policy checks are disabled by default and not commonly used by applications, the real-world impact is limited (Ubuntu Security).

Applications requiring OpenSSL to perform certificate policy checks should use X509VERIFYPARAMset1policies() or explicitly enable the policy check by calling X509VERIFYPARAMsetflags() with the X509VFLAGPOLICYCHECK flag argument. Due to the low severity of this issue, OpenSSL maintained the existing behavior of X509VERIFYPARAMadd0policy() to avoid breaking existing deployments (OpenSSL Advisory).