Threat Brief: CVE-2022-3786 and CVE-2022-3602: OpenSSL X.509 Buffer Overflows
Summary: On November 1, 2022, OpenSSL released an advisory for two high severity vulnerabilities, CVE-2022-3786 and CVE-2022-3602, affecting versions 3.0.0 through 3.0.6, with the patch in 3.0.7; versions 1.1.1 and 1.0.2 are not affected. Both flaws sit in the ossl_punycode_decode function and are triggered through X.509 certificate verification, specifically name constraint checking, requiring a malicious certificate signed by a CA or an application that continues verification after failing to build a path to a trusted issuer.
What you should know: There are no known instances of exploitation, but publicly available proof-of-concept code lets anyone who can create and sign a malicious certificate crash unpatched servers, and because OpenSSL ships as source code, an end user who opts out of stack cookies, ASLR or DEP/NX raises the risk of remote code execution for CVE-2022-3786.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-3602CVE-2022-3786
- Related
- Threat Advisory: High Severity OpenSSL Vulnerabilities Cyber Risks ·