Back

Insecure Trust of Self-Signed Certificates in Bitdefender Total Security HTTPS Scanning (VA-11164)

Publication date: October 18th, 2024


CVE ID:
CVE-2023-6056
CVSS scrore:
8.6 - CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Affected vendors:
Bitdefender
Affected products:
Total Security
Vulnerability details:

A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of self-signed certificates. The product is found to trust certificates signed with the RIPEMD-160 hashing algorithm without proper validation, allowing an attacker to establish MITM SSL connections to arbitrary sites.

Additional details:
An automatic update to product version 27.0.25.115 fixes the issue.