WordPress Core < 5.8.2 - ca-bundle.crt contains expired certificate DST Root CA X3

2021-11-10 00:00
Anonymous

Strategic Overview

Status
Patched in 5.2.13
Affected Core
WordPress 5.8
Affected Version
5.2 – 5.8.1 · 8 branches
CVSS
5.3Medium
Weakness type
CWE-324 · Use of a Key Past its Expiration Date
CVE
CVE pending
View all WordPress 5.8 vulnerabilities

At a glance

This record tracks a medium-severity Use of a Key Past its Expiration Date vulnerability in the WordPress 5.8 WordPress release line, affecting 5.2 – 5.8.1 · 8 branches. It carries a CVSS score of 5.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 5.2.13; sites on affected versions should update now. Disclosed November 2021.

Vulnerability Overview

WordPress Core in various versions less than version 5.8.2 contained an expired DST Root CA X3 certificate. There is no significant security risk to most WordPress users.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.

CWE-324: Use of a Key Past its Expiration Date

The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.

Remediation

Update to one of the following versions, or a newer patched version: 5.2.13, 5.3.10, 5.4.8, 5.5.7, 5.6.6, 5.7.4, 5.8.2

How does WordSec protect against this?

The fix is the thing that ends this: updating to 5.2.13 is the step that ends it.

  • Alerts

External References

https://www.wordfence.com/threat-intel/vulnerabilities/id/0ba551a4-109d-4e28-b497-539264095134

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C