Service Notices

All Notices > Security Notices > OpenSSL Buffer Overflow Vulnerabilities (CVE-2022-3602 and CVE-2022-3786)

OpenSSL Buffer Overflow Vulnerabilities (CVE-2022-3602 and CVE-2022-3786)

Nov 07, 2022 GMT+08:00

I. Overview

Recently, it has been disclosed that there are two high-risk buffer overflow vulnerabilities (CVE-2022-3602 and CVE-2022-3786) in OpenSSL 3.0.x versions. OpenSSL has a defect in X.509 certificate verification, which allows malicious email addresses to trigger buffer overflow. Successful exploitation of this vulnerability can cause denial of service (DoS) or remote code execution.

OpenSSL is a powerful secure socket layer password library. If you are an OpenSSL user, check your OpenSSL version and implement timely security hardening.

Reference: https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/

II. Severity

Severity: important

(Severity: low, moderate, important, and critical)

III. Affected Products

Affected versions:

3.0.0 <= OpenSSL < 3.0.7

Secure versions:

OpenSSL 3.0.7

OpenSSL 1.x and 2.x versions are not affected by the two vulnerabilities.

IV. Security Recommendations

The two vulnerabilities have been fixed in version 3.0.7. Upgrade your affected versions to a secure version.

https://www.openssl.org/source/

Note: Before fixing vulnerabilities, back up your files and conduct a thorough test.