CVE-2023-41991

A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.apple.com/en-us/HT213927	Release Notes Vendor Advisory
https://support.apple.com/en-us/HT213931	Release Notes Vendor Advisory
https://support.apple.com/en-us/HT213927	Release Notes Vendor Advisory
https://support.apple.com/en-us/HT213931	Release Notes Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:ipados:17.0:::::::*
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:iphone_os:17.0:::::::*
	cpe:2.3:o:apple:macos::::::::

History

21 Nov 2024, 08:22

Type	Values Removed	Values Added
References	~~() https://support.apple.com/en-us/HT213927 - Release Notes, Vendor Advisory~~	() https://support.apple.com/en-us/HT213927 - Release Notes, Vendor Advisory
References	~~() https://support.apple.com/en-us/HT213931 - Release Notes, Vendor Advisory~~	() https://support.apple.com/en-us/HT213931 - Release Notes, Vendor Advisory

10 Jan 2024, 22:15

Type	Values Removed	Values Added
References	~~{'url': 'http://seclists.org/fulldisclosure/2023/Oct/4', 'name': 'http://seclists.org/fulldisclosure/2023/Oct/4', 'tags': [], 'refsource': ''}~~ ~~{'url': 'http://seclists.org/fulldisclosure/2023/Oct/5', 'name': 'http://seclists.org/fulldisclosure/2023/Oct/5', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'MISC'}~~

07 Nov 2023, 04:21

Type	Values Removed	Values Added
References		() http://seclists.org/fulldisclosure/2023/Oct/4 -

24 Oct 2023, 12:56

Type	Values Removed	Values Added
CPE		cpe:2.3:o:apple:iphone_os:17.0:::::::* cpe:2.3:o:apple:ipados:17.0:::::::*

12 Oct 2023, 02:45

Type	Values Removed	Values Added
CPE	cpe:2.3:o:apple:iphone_os:17.0:::::::* cpe:2.3:o:apple:watchos:10.0.0:::::::* cpe:2.3:o:apple:watchos:::::::: cpe:2.3:o:apple:ipad_os:::::::: cpe:2.3:o:apple:ipad_os:17.0:::::::*	cpe:2.3:o:apple:ipados::::::::
First Time		Apple ipados
References	~~(MISC) https://support.apple.com/en-us/HT213931 - Vendor Advisory~~	(MISC) https://support.apple.com/en-us/HT213931 - Release Notes, Vendor Advisory
References	~~(MISC) https://support.apple.com/en-us/HT213927 - Vendor Advisory~~	(MISC) https://support.apple.com/en-us/HT213927 - Release Notes, Vendor Advisory
References	~~(MISC) http://seclists.org/fulldisclosure/2023/Oct/5 -~~	(MISC) http://seclists.org/fulldisclosure/2023/Oct/5 - Mailing List, Third Party Advisory

03 Oct 2023, 06:15

Type	Values Removed	Values Added
References		(MISC) http://seclists.org/fulldisclosure/2023/Oct/5 -

27 Sep 2023, 15:19

Type	Values Removed	Values Added
Summary	A certificate validation issue was addressed. This issue is fixed in iOS 16.7 and iPadOS 16.7, OS 17.0.1 and iPadOS 17.0.1, watchOS 9.6.3, macOS Ventura 13.6, watchOS 10.0.1. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.	A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
References	~~{'url': 'https://support.apple.com/en-us/HT213926', 'name': 'https://support.apple.com/en-us/HT213926', 'tags': ['Vendor Advisory'], 'refsource': 'MISC'}~~ ~~{'url': 'https://support.apple.com/kb/HT213926', 'name': 'https://support.apple.com/kb/HT213926', 'tags': ['Vendor Advisory'], 'refsource': 'MISC'}~~ ~~{'url': 'http://seclists.org/fulldisclosure/2023/Sep/15', 'name': 'http://seclists.org/fulldisclosure/2023/Sep/15', 'tags': ['Third Party Advisory'], 'refsource': 'MISC'}~~ ~~{'url': 'http://seclists.org/fulldisclosure/2023/Sep/17', 'name': 'http://seclists.org/fulldisclosure/2023/Sep/17', 'tags': ['Third Party Advisory'], 'refsource': 'MISC'}~~ ~~{'url': 'http://seclists.org/fulldisclosure/2023/Sep/14', 'name': 'http://seclists.org/fulldisclosure/2023/Sep/14', 'tags': ['Third Party Advisory'], 'refsource': 'MISC'}~~ ~~{'url': 'https://support.apple.com/en-us/HT213929', 'name': 'https://support.apple.com/en-us/HT213929', 'tags': ['Vendor Advisory'], 'refsource': 'MISC'}~~ ~~{'url': 'http://seclists.org/fulldisclosure/2023/Sep/19', 'name': 'http://seclists.org/fulldisclosure/2023/Sep/19', 'tags': ['Third Party Advisory'], 'refsource': 'MISC'}~~ ~~{'url': 'https://support.apple.com/en-us/HT213928', 'name': 'https://support.apple.com/en-us/HT213928', 'tags': ['Vendor Advisory'], 'refsource': 'MISC'}~~ ~~{'url': 'http://seclists.org/fulldisclosure/2023/Sep/16', 'name': 'http://seclists.org/fulldisclosure/2023/Sep/16', 'tags': ['Third Party Advisory'], 'refsource': 'MISC'}~~

25 Sep 2023, 16:17

23 Sep 2023, 03:15

Type	Values Removed	Values Added
References		(MISC) http://seclists.org/fulldisclosure/2023/Sep/15 - (MISC) http://seclists.org/fulldisclosure/2023/Sep/17 - (MISC) http://seclists.org/fulldisclosure/2023/Sep/14 - (MISC) http://seclists.org/fulldisclosure/2023/Sep/19 - (MISC) http://seclists.org/fulldisclosure/2023/Sep/16 -

21 Sep 2023, 20:15

Type	Values Removed	Values Added
References		(MISC) https://support.apple.com/kb/HT213926 -

21 Sep 2023, 19:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-09-21 19:15

Updated : 2024-11-21 08:22

NVD link : CVE-2023-41991

Mitre link : CVE-2023-41991

CVE.ORG link : CVE-2023-41991

JSON object : View

Products Affected

apple

iphone_os
macos
ipados

CWE

CWE-295

Improper Certificate Validation

5.5 /10