huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2022-50866: kernel: ASoC: pxa: fix null-pointer dereference in filter()
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel ASoC pxa audio driver. The function filter() used kasprintf() to allocate a formatted string but did not check whether the allocation succeeded before passing the result to strcmp(). If memory allocation fails and kasprintf() returns NULL, this results in a NULL pointer dereference when calling strcmp(), which can trigger a kernel crash and denial of service.


Affected upstream versions: 3.6
Fixed upstream versions: 0, 4.14.303, 4.19.270, 4.9.337, 5.10.163, 5.15.86, 5.4.229, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3ec75e0ea9550b8f2e531172f2e67ba9d5227ec3
CVE-2022-50878: kernel: Linux kernel: Denial of service in lontium-lt9611 GPU driver due to NULL pointer dereference
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.3 (CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel's lontium-lt9611 GPU driver. A local user with low privileges could trigger a NULL pointer dereference in the `lt9611_connector_init()` function. This vulnerability can lead to a system crash, resulting in a Denial of Service (DoS).


Affected upstream versions: 5.10
Fixed upstream versions: 0, 5.10.150, 5.15.75, 5.19.17, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3959e8faf8bf6bea619e8856c736db64e6eced37
CVE-2022-50879: kernel: objtool: Fix SEGFAULT
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 0 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N)
Public date: 2025-12-30T00:00:00+00:00

A NULL pointer dereference was found in objtool, a build-time tool used during Linux kernel compilation. When find_insn() returns NULL on failure, the code proceeds to dereference the NULL pointer, causing objtool to crash with a segmentation fault during kernel build operations.

Statement: This is not a runtime kernel vulnerability. Objtool is a userspace build-time tool that runs during kernel compilation to validate object files. A crash in objtool affects the kernel build process only and has no impact on running systems. This should not be classified as a kernel security vulnerability.

Affected upstream versions: 4.9.106 < 4.10, 4.14.48 < 4.15, 4.16.14 < 4.17, 4.17
Fixed upstream versions: 0, 4.10, 4.15, 4.17, 5.10.163, 5.15.87, 5.4.229, 6.0.17, 6.1.3, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 418ef921cce2d7415fab7e3e93529227f239e4bb
CVE-2022-50881: kernel: wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect()
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-12-30T00:00:00+00:00

A use-after-free flaw was discovered in the ath9k USB Wi-Fi driver in the Linux kernel. During the disconnect and deinitialization sequence (ath9k_hif_usb_disconnect()), the driver could attempt to access its private data (drv_priv) after it has already been freed by the hardware teardown call (ieee80211_free_hw() via ath9k_htc_hw_deinit()). This improper ordering can cause the kernel to reference freed memory, leading to undefined behavior including kernel warnings or crashes under certain conditions.


Affected upstream versions: 4.4.228 < 4.5, 4.9.228 < 4.10, 4.14.185 < 4.15, 4.19.129 < 4.20, 5.4.47 < 5.5, 5.6.19 < 5.7, 5.7.3 < 5.8, 5.8
Fixed upstream versions: 0, 4.10, 4.15, 4.20, 4.5, 5.10.173, 5.15.99, 5.5, 5.7, 5.8, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 99ff971b62e5bd5dee65bbe9777375206f5db791
CVE-2022-50882: kernel: media: uvcvideo: Fix memory leak in uvc_gpio_parse
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A memory leak was found in the UVC video driver's GPIO parsing code. When IRQ acquisition fails for a privacy GPIO, the previously allocated unit buffer is not freed, causing a memory leak.

Statement: This leak occurs only when probing UVC cameras with privacy GPIOs that fail IRQ acquisition. The impact is limited to minor memory consumption during camera enumeration failures.

Affected upstream versions: 5.12
Fixed upstream versions: 0, 5.15.75, 5.19.17, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6c5da92103bddd1f0c36cb69446ff7cae3043986
CVE-2022-50884: kernel: drm: Prevent drm_copy_field() to attempt copying a NULL pointer
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A NULL pointer dereference flaw was found in the Linux kernel's DRM subsystem. When a graphics driver incorrectly fails to initialize required fields in the drm_driver structure, the drm_copy_field() function attempts to copy from a NULL pointer when handling the DRM_IOCTL_VERSION ioctl, causing a kernel crash.

Statement: This vulnerability requires a buggy DRM driver that fails to set mandatory fields. Standard upstream drivers set these fields correctly, so this primarily affects development or out-of-tree driver scenarios. The fix adds defensive NULL checks to prevent crashes from driver bugs.

Affected upstream versions: 2.6.16
Fixed upstream versions: 0, 4.14.296, 4.19.262, 4.9.331, 5.10.150, 5.15.75, 5.19.17, 5.4.220, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d213914386a0ede76a4549b41de30192fb92c595
CVE-2022-50886: kernel: mmc: toshsd: fix return value check of mmc_add_host()
Component: kernel
Severity: Low
CWE: CWE-252 (Unchecked Return Value)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel's Toshiba SD/MMC card reader driver (toshsd). The driver fails to check the return value of mmc_add_host(). If this function fails, memory allocated by mmc_alloc_host() is leaked, and a subsequent driver removal attempt will crash the kernel by trying to delete a device that was never added.

Statement: This flaw affects systems with Toshiba SD/MMC card readers using the toshsd driver. The issue only manifests when mmc_add_host() fails during driver initialization, which is an uncommon error condition. The practical security impact is limited as it requires both specific hardware and an initialization failure to trigger.

Affected upstream versions: 3.19
Fixed upstream versions: 0, 4.14.303, 4.19.270, 4.9.337, 5.10.163, 5.15.86, 5.4.229, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 34ae492f8d172f0bd193c24cad588b35419ea47a
CVE-2022-50889: kernel: dm integrity: Fix UAF in dm_integrity_dtr()
Component: kernel
Severity: Low
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel's device mapper integrity subsystem. When dm_resume() and dm_destroy() execute concurrently, a timer may fire and access freed memory because dm_integrity_dtr() did not properly cancel the timer before freeing resources. The fix adds an additional timer cancellation in the destructor path.

Statement: This flaw requires a race condition between dm_resume() and dm_destroy() operations on a dm-integrity device. While use-after-free bugs can have serious consequences, the narrow timing window and requirement for privileged device-mapper operations significantly limit exploitability in practice.

Affected upstream versions: 4.12
Fixed upstream versions: 0, 5.10.163, 5.15.87, 5.4.229, 6.0.18, 6.1.4, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 792e51aac376cfb5bd527c2a30826223b82dd177
CVE-2023-0215: openssl: use-after-free following BIO_new_NDEF
Component: openssl
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-02-07T00:00:00+00:00

A use-after-free vulnerability was found in OpenSSL's BIO_new_NDEF function. The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally by OpenSSL to support the SMIME, CMS, and PKCS7 streaming capabilities, but it may also be called directly by end-user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions. For example, if a CMS recipient public key is invalid, the new filter BIO is freed, and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up, and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then calls BIO_pop() on the BIO, a use-after-free will occur, possibly resulting in a crash.

Statement: This flaw was found in the OpenSSL library within the BIO_new_NDEF function, which is used for ASN.1 data streaming. The flaw is a use-after-free issue that happens when an error occurs while setting up a BIO chain. In this case, the filter BIO is freed, but the original BIO still holds a reference to it. If the caller later calls BIO_pop(), it tries to use this freed pointer, causing a crash and leading to a Denial of Service (DoS). The flaw is rated as moderate because it results in a crash but does not allow code execution, memory corruption beyond the crash, or data leakage.

Affected upstream versions: 3.0.0 < 3.0.8, 1.1.1 < 1.1.1t, 1.0.2 < 1.0.2zg
Fixed upstream versions: 1.0.2zg, 1.1.1t, 3.0.8
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 8818064ce3c3c0f1b740a5aaba2a987e75bfbafd
CVE-2023-0216: openssl: invalid pointer dereference in d2i_PKCS7 functions
Component: openssl
Severity: Moderate
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-02-07T00:00:00+00:00

A flaw was found in OpenSSL. An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. This may result in an application crash which could lead to a denial of service. The TLS implementation in OpenSSL does not call this function, however, third party applications might call these functions on untrusted data.

Statement: Red Hat Enterprise Linux 6, 7, and 8 ships OpenSSL 1.1.1 and 1.0.2 which do not contain the incorrect code, so those are not affected by this CVE. Similarly, the versions of `shim` as shipped with Red Hat Enterprise Linux 8 and 9 are not affected by this issue.

Affected upstream versions: 3.0.0 < 3.0.8
Fixed upstream versions: 3.0.8
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 934a04f0e775309cadbef0aa6b9692e1b12a76c6
CVE-2023-0217: openssl: NULL dereference validating DSA public key
Component: openssl
Severity: Moderate
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-02-07T00:00:00+00:00

A flaw was found in OpenSSL. An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function, most likely leading to an application crash. This function can be called on public keys supplied from untrusted sources, which could allow an attacker to cause a denial of service.

Statement: Red Hat Enterprise Linux 6, 7, and 8 ships OpenSSL 1.1.1 and 1.0.2 which do not contain the incorrect code, so those are not affected by this CVE. Similarly, the versions of `shim` as shipped with Red Hat Enterprise Linux 8 and 9 are not affected by this issue.

Affected upstream versions: 3.0.0 < 3.0.8
Fixed upstream versions: 3.0.8
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 23985bac83fd50c8e29431009302b5442f985096
CVE-2023-0266: ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
Component: ALSA
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-01-13T06:30:00+00:00

A use-after-free flaw was found in snd_ctl_elem_read in sound/core/control.c in Advanced Linux Sound Architecture (ALSA) subsystem in the Linux kernel. In this flaw a normal privileged, local attacker may impact the system due to a locking issue in the compat path, leading to a kernel information leak problem.


Affected upstream versions: <= v6.1
Fixed upstream versions: v6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 56b88b50565cd8b946a2d00b0c83927b7ebb055e
CVE-2023-0286: openssl: X.400 address type confusion in X.509 GeneralName
Component: openssl
Severity: Important
CWE: CWE-704 (Incorrect Type Conversion or Cast)
CVSS v3: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H)
Public date: 2023-02-07T00:00:00+00:00

A type confusion vulnerability was found in OpenSSL when OpenSSL X.400 addresses processing inside an X.509 GeneralName. When CRL checking is enabled (for example, the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or cause a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, of which neither needs a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. In this case, this vulnerability is likely only to affect applications that have implemented their own functionality for retrieving CRLs over a network.

Statement: For shim in Red Hat Enterprise Linux 8 & 9, is not affected as shim doesn't support any CRL processing.

Affected upstream versions: 3.0.0 < 3.0.8, 1.1.1 < 1.1.1t, 1.0.2 < 1.0.2zg
Fixed upstream versions: 1.0.2zg, 1.1.1t, 3.0.8
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 2f7530077e0ef79d98718138716bc51ca0cad658
CVE-2023-0386: kernel: FUSE filesystem low-privileged user privileges escalation
Component: kernel
Severity: Important
CWE: CWE-282 (Improper Ownership Management)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-01-24T10:00:00+00:00

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

Statement: This vulnerability was first introduced into Red Hat Enterprise Linux starting in version 8.6. Earlier releases are not affected, including Red Hat Enterprise Linux 8.4.

Affected upstream versions: Linux kernel 6.2-rc6
Fixed upstream versions: v6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 4f11ada10d0a
CVE-2023-0394: kernel: NULL pointer dereference in rawv6_push_pending_frames
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-01-17T17:30:00+00:00

A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash.


Affected upstream versions: Linux kernel prior to Kernel 6.2 RC4
Fixed upstream versions: v6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: cb3e9864cdbe35ff6378966660edbcbac955fe17
CVE-2023-0401: openssl: NULL dereference during PKCS7 data verification
Component: openssl
Severity: Moderate
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-02-07T00:00:00+00:00

A NULL pointer vulnerability was found in OpenSSL, which can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available, the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API, most likely leading to a crash.

Statement: Red Hat Enterprise Linux 6, 7, and 8 ships OpenSSL 1.1.1 and 1.0.2 which do not contain the incorrect code, so those are not affected by this CVE. Similarly, the versions of `shim` as shipped with Red Hat Enterprise Linux 8 and 9 are not affected by this issue.

Affected upstream versions: 3.0.0 < 3.0.8
Fixed upstream versions: 3.0.8
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: d3b6dfd70db844c4499bec6ad6601623a565e674
CVE-2023-0458: kernel: speculative pointer dereference in do_prlimit() in kernel/sys.c
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2023-01-21T00:00:00+00:00

A vulnerabilty was found in Linux Kernel, where a speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents.


Affected upstream versions: <= v6.1
Fixed upstream versions: v6.2
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 739790605705ddcf18f21782b9c99ad7d53a8c11
CVE-2023-0459: kernel: Copy_from_user on 64-bit versions may leak kernel information
Component: kernel
Severity: Low
CWE: CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-02-15T06:30:00+00:00

A vulnerability was found in copy_from_user in 64-bit versions of the Linux kernel. This flaw allows a local attacker to bypass the "access_ok" sanity check and pass a kernel pointer to copy_from_user(), resulting in kernel data leaking.


Affected upstream versions: <= v5.5
Fixed upstream versions: v5.7
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 4b842e4e25b12951fa10dedb4bc16bc47e3b850c
CVE-2023-0461: kernel: net/ulp: use-after-free in listening ULP sockets
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-02-23T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel’s TLS protocol functionality in how a user installs a tls context (struct tls_context) on a connected TCP socket. This flaw allows a local user to crash or potentially escalate their privileges on the system.

Statement: Versions of Red Hat Enterprise Linux before 8 are not affected by this vulnerability as they did not include the upstream commit 734942c ("tcp: ULP infrastructure").

Affected upstream versions: <= v6.1
Fixed upstream versions: v6.2
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 2c02d41d71f90a5168391b6a5f2954112ba2307c
CVE-2023-0464: openssl: Denial of service by excessive resource usage in verifying X509 policy constraints
Component: openssl
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-03-22T00:00:00+00:00

A security vulnerability has been identified in all supported OpenSSL versions related to verifying X.509 certificate chains that include policy constraints. This flaw allows attackers to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial of service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the -policy' argument to the command line utilities or calling the X509_VERIFY_PARAM_set1_policies()' function.

Statement: This vulnerability is classified as low severity because policy processing in OpenSSL is disabled by default, meaning that most deployments are unaffected unless explicitly configured to enable policy checks. Additionally, while the flaw can cause exponential computational resource consumption, it does not allow for remote code execution, memory corruption, or data exfiltration—limiting its impact to a denial-of-service (DoS) condition. Exploiting this issue also requires an attacker to supply a specifically crafted X.509 certificate chain, which is only feasible in scenarios where certificate validation of untrusted chains is performed, further reducing the practical risk.

Affected upstream versions: 3.1.0 < 3.1.1, 3.0.0 < 3.0.9, 1.1.1 < 1.1.1u, 1.0.2 < 1.0.2zh
Fixed upstream versions: 1.0.2zh, 1.1.1u, 3.0.9, 3.1.1
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 2017771e2db3e2b96f89bbe8766c3209f6a99545
CVE-2023-0465: openssl: Invalid certificate policies in leaf certificates are silently ignored
Component: openssl
Severity: Low
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Public date: 2023-03-28T00:00:00+00:00

A flaw was found in OpenSSL. Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. OpenSSL and other certificate policy checks silently ignore invalid certificate policies in leaf certificates that are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function.

Statement: Red Hat has determined that this flaw is of low impact because it only affects applications that use a non-default configuration (enabling policy processing), requires a malicious CA, and does not compromise cryptographic integrity or directly enable system exploitation.

Affected upstream versions: 3.1.0 < 3.1.1, 3.0.0 < 3.0.9, 1.1.1 < 1.1.1u, 1.0.2 < 1.0.2zh
Fixed upstream versions: 1.0.2zh, 1.1.1u, 3.0.9, 3.1.1
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: facfb1ab745646e97a1920977ae4a9965ea61d5c