CVE-2023-40012

    Dashboard / Vulnerabilities / CVE-2023-40012

    CVE-2023-40012

    Published: 9 Aug 2023Last Modified: 12 Aug 2026

    Summary: uthenticode EKU validation bypass

    Details: uthenticode is a small cross-platform library for partially verifying Authenticode digital signatures. Versions of uthenticode prior to the 2.x series did not check Extended Key Usages in certificates, in violation of the Authenticode X.509 certificate profile. As a result, a malicious user could produce a "signed" PE file that uthenticode would verify and consider valid using an X.509 certificate that isn't entitled to produce code signatures (e.g., a SSL certificate). By design, uthenticode does not perform full-chain validation. However, the absence of EKU validation was an unintended oversight. The 2.0.0 release series includes EKU checks. There are no workarounds to this vulnerability.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40012.json, https://github.com/trailofbits/uthenticode/security/advisories/GHSA-gm2f-j4rj-6xqj, https://nvd.nist.gov/vuln/detail/CVE-2023-40012, https://github.com/trailofbits/uthenticode/commit/caeb1eb62412605f71bd96ce9bb9420644b6db53, https://github.com/trailofbits/uthenticode/pull/78

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -fbb7b3cc95643c8c567d9ef02bd7c60d7678ac2a

    Affected versions

    v2.0.0.pre.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-40012 | CVE-DB