CVE-2022-3602
highPriorität · beachten · 72EPSS 0.908 · 100. PerzentilExploit · PoCDEEURUUSEPSS · bewertet 2026-10-23
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6).
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenCalibre ICEsiemens_psirt
Update to V2023.1 or later version
- BehobenMcentersiemens_psirt
Update to V5.3.0 or later version
https://download.industrysoftware.automation.siemens.com/ - BehobenSCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2)siemens_psirt
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - BehobenSCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2)siemens_psirt
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - BehobenSCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3)siemens_psirt
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - BehobenSCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3)siemens_psirt
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - BehobenSCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3)siemens_psirt
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - BehobenSICAM GridPasssiemens_psirt
Update to V2.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763384/ - BehobenSIMATIC RTLS Locating Managersiemens_psirt
Update to V2.13.0.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821005/ - BehobenCalibre ICEcisa_csaf_ot
Update to V2023.1 or later version
- BehobenMcentercisa_csaf_ot
Update to V5.3.0 or later version
https://download.industrysoftware.automation.siemens.com/ - BehobenSCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2)cisa_csaf_ot
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - BehobenSCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2)cisa_csaf_ot
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - BehobenSCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3)cisa_csaf_ot
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - BehobenSCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3)cisa_csaf_ot
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - BehobenSCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3)cisa_csaf_ot
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - BehobenSICAM GridPasscisa_csaf_ot
Update to V2.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763384/ - BehobenSIMATIC RTLS Locating Managercisa_csaf_ot
Update to V2.13.0.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821005/ - BehobenCalibre ICEcisa_csaf_ot
Update to V2023.1 or later version
https://support.sw.siemens.com/ - BehobenSICAM GridPass (6MD7711-2AA00-1EA0)cisa_csaf_ot
Update to V2.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763384/ - BehobenPCU400cisa_csaf_ot
PCU400: Version 9.3.8 or 9.4 or later
- BehobenPCULogger toolcisa_csaf_ot
PCU400: Version 9.3.8 or 9.4 or later
- MitigationCalibre ICEsiemens_psirt
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationMcentersiemens_psirt
As a mitigation for vulnerable versions: Ensure that only trusted (CA) certificates are contained in the Machine Agent's truststore
- MitigationSCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2)siemens_psirt
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2)siemens_psirt
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3)siemens_psirt
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3)siemens_psirt
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3)siemens_psirt
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSICAM GridPasssiemens_psirt
As a mitigation for vulnerable versions: In the truststore, do not add CA certificates that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSIMATIC RTLS Locating Managersiemens_psirt
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationCalibre ICEcisa_csaf_ot
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationMcentercisa_csaf_ot
As a mitigation for vulnerable versions: Ensure that only trusted (CA) certificates are contained in the Machine Agent's truststore
- MitigationSCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2)cisa_csaf_ot
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2)cisa_csaf_ot
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3)cisa_csaf_ot
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3)cisa_csaf_ot
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3)cisa_csaf_ot
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSICAM GridPasscisa_csaf_ot
As a mitigation for vulnerable versions: In the truststore, do not add CA certificates that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSIMATIC RTLS Locating Managercisa_csaf_ot
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationCalibre ICEcisa_csaf_ot
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
- MitigationMcentercisa_csaf_ot
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
- MitigationSCALANCE X-200RNA switch familycisa_csaf_ot
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
- MitigationSICAM GridPass (6MD7711-2AA00-1EA0)cisa_csaf_ot
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
- MitigationSIMATIC RTLS Locating Manager (6GT2780-0DA00)cisa_csaf_ot
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
- MitigationSCALANCE X-200RNA switch familycisa_csaf_ot
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSICAM GridPass (6MD7711-2AA00-1EA0)cisa_csaf_ot
As a mitigation for vulnerable versions: In the truststore, do not add CA certificates that contain a nameConstraint-extension ( https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationLumada APMcisa_csaf_ot
Carefully scan portable computers and removable storage media for viruses before connection to a control system.
- MitigationPCU400cisa_csaf_ot
Apply security updates to installed software components.
- MitigationPCULogger toolcisa_csaf_ot
Apply security updates to installed software components.
- MitigationICONICS Suite including GENESIS64, Hyper Historian, AnalytiX, and MobileHMIcisa_csaf_ot
Additional information about the security updates may also be found in Mitsubishi Electric's security advisories:
- Kein Fix verfügbarcisco_csaf
No remediation is available at this time.
- Kein Fix verfügbarMcentercisa_csaf_ot
Currently no fix is available
- Kein Fix verfügbarSCALANCE X-200RNA switch familycisa_csaf_ot
Currently no fix is available
- Kein Fix verfügbarSIMATIC RTLS Locating Manager (6GT2780-0DA00)cisa_csaf_ot
Currently no fix is available
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–critical · 5.9–9.8
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
Exploits (8)
Öffentlicher Proof-of-Concept- und Exploit-Code.
- attilaszia/cve-2022-3602cve-2022-3602 pocPoC · poc_in_github
- colmmacc/CVE-2022-3602colmmacc/CVE-2022-3602PoC · poc_in_github
betroffene Produkte (106)
Betroffene Produkte und Versionsbereiche.
Advisories (15)
Hersteller- und Ökosystem-Meldungen dazu.
- SSA-408105SSA-408105: Buffer Overflow Vulnerabilities in OpenSSL 3.0 Affecting Siemens Products2022-12-13csaf · siemens_psirtDE
The openSSL component, versions 3.0.0 through 3.0.6, contains two buffer overflow vulnerabilities (CVE-2022-3602, CVE-2022-3786) in the X.509 certificate verification [0]. They could allow an attacker to create a denial of service condition or execute arbitrary code on a vulnerable TLS server (if the server requests client certificate authentication), or on a vulnerable TLS client. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available. [0] https://www.openssl.org/news/secadv/20221101.txt
- WID-SEC-W-2022-1922OpenSSL: Mehrere SchwachstellenDeutsch2022-11-01csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in OpenSSL ausnutzen, um einen Denial of Service Zustand herbeizuführen und potenziell um beliebigen Programmcode auszuführen.
- WID-SEC-W-2023-0561Xerox FreeFlow Print Server: Mehrere SchwachstellenDeutsch2023-03-02csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität des Systems zu gefährden.
- WID-SEC-W-2023-1969HPE Fabric OS: Mehrere Schwachstellen ermöglichen PrivilegieneskalationDeutsch2023-08-06csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in HPE Fabric OS für HPE Fibre Channel und SAN Switches ausnutzen, um seine Privilegien zu erhöhen, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.
- cisco-sa-openssl-W9sdCc2aVulnerabilities in OpenSSL Affecting Cisco Products: November 20222022-10-28csaf · cisco_csafUS
On November 1, 2022, the OpenSSL Project announced the following vulnerabilities: CVE-2022-3602 - X.509 Email Address 4-byte Buffer Overflow CVE-2022-3786 - X.509 Email Address Variable Length Buffer Overflow For a description of these vulnerabilities, see OpenSSL Security Advisory [Nov 1 2022] ["https://www.openssl.org/news/secadv/20221101.txt"]. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-W9sdCc2a ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-W9sdCc2a"]
- GHSA-8rwr-x37p-mx23X.509 Email Address 4-byte Buffer Overflow2022-11-01ghsa · osvUS
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.
- ICSA-22-349-09Siemens Products affected by OpenSSL 3.02022-12-13icsa · cisa_csaf_otUS
The openSSL component, versions 3.0.0 through 3.0.6, contains two buffer overflow vulnerabilities (CVE-2022-3602, CVE-2022-3786) in the X.509 certificate verification [0]. They could allow an attacker to create a denial of service condition or execute arbitrary code on a vulnerable TLS server (if the server requests client certificate authentication), or on a vulnerable TLS client. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available. [0] https://www.openssl.org/news/secadv/20221101.txt
- ICSA-22-349-10Siemens APOGEE/TALON Field Panels2022-12-15icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker to hijack existing sessions or spoof future sessions.
- ICSA-22-349-12Siemens Parasolid2022-12-13icsa · cisa_csaf_otUS
The openSSL component, versions 3.0.0 through 3.0.6, contains two buffer overflow vulnerabilities (CVE-2022-3602, CVE-2022-3786) in the X.509 certificate verification [0]. They could allow an attacker to create a denial of service condition or execute arbitrary code on a vulnerable TLS server (if the server requests client certificate authentication), or on a vulnerable TLS client. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available. [0] https://www.openssl.org/news/secadv/20221101.txt
- ICSA-23-005-03Hitachi Energy Lumada Asset Performance Management2023-01-05icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could cause a denial-of-service condition or unauthorized remote arbitrary code execution.
- ICSA-23-019-01Hitachi Energy PCU4002023-01-19icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could result in a denial-of-service condition on both the logging function of the device and its associated server.
- ICSA-23-229-01ICONICS and Mitsubishi Electric Products2023-08-17icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could result in information disclosure, denial-of-service, or remote code execution.
- BIT-node-2022-3602X.509 Email Address 4-byte Buffer Overflow2024-03-06vendor · osvUS
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6).
- BIT-node-min-2022-3602X.509 Email Address 4-byte Buffer Overflow2024-12-16vendor · osvUS
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6).
- RUSTSEC-2022-0064X.509 Email Address 4-byte Buffer Overflow2022-11-01vendor · osvUS
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.
auch bekannt als (8)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202210-2605cnnvd
- EUVD-2022-7287enisa_euvd
- BDU:2022-06608fstec_bdu
- GHSA-8rwr-x37p-mx23enisa_euvd
- BIT-node-2022-3602osv
- BIT-node-min-2022-3602osv
- GHSA-8rwr-x37p-mx23osv
- RUSTSEC-2022-0064osv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (138)
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2022/11/01/15cnnvd
- http://www.openwall.com/lists/oss-security/2022/11/01/16cnnvd
- http://www.openwall.com/lists/oss-security/2022/11/01/17cnnvd
- http://www.openwall.com/lists/oss-security/2022/11/01/18cnnvd
- http://www.openwall.com/lists/oss-security/2022/11/01/19cnnvd
- http://www.openwall.com/lists/oss-security/2022/11/01/20cnnvd
- http://www.openwall.com/lists/oss-security/2022/11/01/21cnnvd
- http://www.openwall.com/lists/oss-security/2022/11/01/24cnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan