Apple Multiple Products Improper Certificate Validation Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-09-25
• EPSS: 13% chance of exploitation in the next 30 days (higher than 96% of CVEs)

[ Description ]Official description

A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

CISA: Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 16 Oct 2023): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• support.apple.com/en-us/HT213927Vendor Advisory
• support.apple.com/en-us/HT213931Vendor Advisory
• support.apple.com/kb/HT213927Vendor Advisory
• support.apple.com/kb/HT213931Vendor Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource