CVE-2023-41991
CVE-2023-41991
In short
A flaw in certificate validation allowed malicious apps to bypass signature checks on Apple devices. This could let attackers run unauthorized code or impersonate trusted applications.
Technical detail
CWE-295 certificate validation bypass affecting iOS, iPadOS, and macOS. A malicious app could circumvent signature verification mechanisms through improper certificate validation logic. The vulnerability has been exploited in the wild against iOS versions prior to 16.7; fixed in macOS Ventura 13.6, iOS 16.7, and iPadOS 16.7.
Summary generated and translated by AI from the official description.
A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
public PoCs found — 2
githubgithub.com/itsgiddd/CVE-2023-41991★ 6githubgithub.com/dmytrozykov/appsign★ 1⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →