CVE-2023-40012
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The uthenticode library prior to the 2.x series did not check Extended Key Usages (EKU) in certificates, violating the Authenticode X.509 certificate profile. This allows a malicious user to create a 'signed' PE file that uthenticode would mistakenly validate using a certificate that is not entitled to produce code signatures.
Risk Assessment
Organizations may be exposed to attacks where malicious PE files are falsely recognized as authorized, potentially leading to the execution of harmful software.
Recommendation
It is recommended to update the uthenticode library to version 2.0.0 or later to ensure proper EKU checks in certificates.
Original NVD description (English source)
uthenticode is a small cross-platform library for partially verifying Authenticode digital signatures. Versions of uthenticode prior to the 2.x series did not check Extended Key Usages in certificates, in violation of the Authenticode X.509 certificate profile. As a result, a malicious user could produce a "signed" PE file that uthenticode would verify and consider valid using an X.509 certificate that isn't entitled to produce code signatures (e.g., a SSL certificate). By design, uthenticode does not perform full-chain validation. However, the absence of EKU validation was an unintended oversight. The 2.0.0 release series includes EKU checks. There are no workarounds to this vulnerability.