QID 38879

OpenSSL has released a high severity security advisory addressing two buffer overrun vulnerabilities (CVE-2022-3602 and CVE-2022-3786) that can be triggered in X.509 certificate verification, specifically in name constraint checking. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution.

Affected Versions:
OpenSSL 3.0.x versions prior to version 3.0.7

QID Detection Logic: Linux (Authenticated)
This QID checks for vulnerable version of OpenSSL by running 'openssl version' command.

QID Detection Logic: Windows (Authenticated)
This QID checks for vulnerable version of OpenSSL by checking the OpenSSL DisplayName value by enumerating the registry keys:
"HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall"
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall".

QID Detection Logic: (Unauthenticated)
This QID checks for vulnerable version of OpenSSL by extracting openssl version from http response header.

Vulnerable version of OpenSSL may allow an attacker to perform a buffer overflow attack that could result in a crash (causing a denial of service) or potentially remote code execution.