QID 377733

Date Published: 2022-11-01

QID 377733: Open Secure Sockets Layer (OpenSSL) Less Than 3.0.7 Buffer Overflow Vulnerability (Scan Utility)

OpenSSL has released a high severity security advisory addressing two buffer overrun vulnerabilities (CVE-2022-3602 and CVE-2022-3786) that can be triggered in X.509 certificate verification, specifically in name constraint checking. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution.

Affected Versions:
OpenSSL 3.0.x versions prior to version 3.0.7

QID Detection Logic: (Authenticated) - Windows
This QID reads the file generated by Qualys utility Qualys OpenSSL Scan Utility for Windows to find vulnerable instances of OpenSSL.

Vulnerable version of OpenSSL may allow an attacker to perform a buffer overflow attack that could result in a crash (causing a denial of service) or potentially remote code execution.

CVSS V3 rated as High - 7.5 severity.

CVSS V2 rated as Critical - 10 severity.

Solution

Vendor has released a patch to address these vulnerabilities. Customers are advised to refer to OpenSSL Security Advisory for more information pertaining to this

Vendor References

OpenSSL 3.0.7 - www.openssl.org/news/secadv/20221101.txt

CVEs related to QID 377733

CVE-2022-3602 | CVE-2022-3786 |

Software Advisories

Advisory ID	Software	Component	Link
OpenSSL 3.0.7			www.openssl.org/news/secadv/20221101.txt

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].