CVE-2024-45341
LowSummary
A certificate with a URI containing an IPv6 address with a zone ID may incorrectly satisfy a URI name constraint in the certificate chain. This vulnerability only affects private PKIs using URIs, as certificates with URIs are not allowed in the public web PKI.
Risk Assessment
Organizations using private PKIs with URI name constraints may face unauthorized authentication or security policy violations if an attacker exploits a certificate with an IPv6 address containing a zone ID.
Recommendation
Update OpenSSL to a version containing the fix for CVE-2024-45341. In the meantime, avoid using IPv6 addresses with zone IDs in certificate URIs within private PKIs.
Original NVD description (English source)
A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.