CVE-2022-3602
highpriority · attend · 72EPSS 0.908 · 100 %ileexploit · PoCDEEURUUSEPSS · scored 2026-10-23
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6).
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedCalibre ICEsiemens_psirt
Update to V2023.1 or later version
- FixedMcentersiemens_psirt
Update to V5.3.0 or later version
https://download.industrysoftware.automation.siemens.com/ - FixedSCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2)siemens_psirt
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - FixedSCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2)siemens_psirt
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - FixedSCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3)siemens_psirt
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - FixedSCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3)siemens_psirt
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - FixedSCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3)siemens_psirt
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - FixedSICAM GridPasssiemens_psirt
Update to V2.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763384/ - FixedSIMATIC RTLS Locating Managersiemens_psirt
Update to V2.13.0.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821005/ - FixedCalibre ICEcisa_csaf_ot
Update to V2023.1 or later version
- FixedMcentercisa_csaf_ot
Update to V5.3.0 or later version
https://download.industrysoftware.automation.siemens.com/ - FixedSCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2)cisa_csaf_ot
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - FixedSCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2)cisa_csaf_ot
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - FixedSCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3)cisa_csaf_ot
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - FixedSCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3)cisa_csaf_ot
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - FixedSCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3)cisa_csaf_ot
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - FixedSICAM GridPasscisa_csaf_ot
Update to V2.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763384/ - FixedSIMATIC RTLS Locating Managercisa_csaf_ot
Update to V2.13.0.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821005/ - FixedCalibre ICEcisa_csaf_ot
Update to V2023.1 or later version
https://support.sw.siemens.com/ - FixedSICAM GridPass (6MD7711-2AA00-1EA0)cisa_csaf_ot
Update to V2.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763384/ - FixedPCU400cisa_csaf_ot
PCU400: Version 9.3.8 or 9.4 or later
- FixedPCULogger toolcisa_csaf_ot
PCU400: Version 9.3.8 or 9.4 or later
- MitigationCalibre ICEsiemens_psirt
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationMcentersiemens_psirt
As a mitigation for vulnerable versions: Ensure that only trusted (CA) certificates are contained in the Machine Agent's truststore
- MitigationSCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2)siemens_psirt
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2)siemens_psirt
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3)siemens_psirt
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3)siemens_psirt
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3)siemens_psirt
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSICAM GridPasssiemens_psirt
As a mitigation for vulnerable versions: In the truststore, do not add CA certificates that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSIMATIC RTLS Locating Managersiemens_psirt
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationCalibre ICEcisa_csaf_ot
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationMcentercisa_csaf_ot
As a mitigation for vulnerable versions: Ensure that only trusted (CA) certificates are contained in the Machine Agent's truststore
- MitigationSCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2)cisa_csaf_ot
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2)cisa_csaf_ot
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3)cisa_csaf_ot
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3)cisa_csaf_ot
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3)cisa_csaf_ot
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSICAM GridPasscisa_csaf_ot
As a mitigation for vulnerable versions: In the truststore, do not add CA certificates that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSIMATIC RTLS Locating Managercisa_csaf_ot
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationCalibre ICEcisa_csaf_ot
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
- MitigationMcentercisa_csaf_ot
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
- MitigationSCALANCE X-200RNA switch familycisa_csaf_ot
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
- MitigationSICAM GridPass (6MD7711-2AA00-1EA0)cisa_csaf_ot
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
- MitigationSIMATIC RTLS Locating Manager (6GT2780-0DA00)cisa_csaf_ot
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
- MitigationSCALANCE X-200RNA switch familycisa_csaf_ot
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSICAM GridPass (6MD7711-2AA00-1EA0)cisa_csaf_ot
As a mitigation for vulnerable versions: In the truststore, do not add CA certificates that contain a nameConstraint-extension ( https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationLumada APMcisa_csaf_ot
Carefully scan portable computers and removable storage media for viruses before connection to a control system.
- MitigationPCU400cisa_csaf_ot
Apply security updates to installed software components.
- MitigationPCULogger toolcisa_csaf_ot
Apply security updates to installed software components.
- MitigationICONICS Suite including GENESIS64, Hyper Historian, AnalytiX, and MobileHMIcisa_csaf_ot
Additional information about the security updates may also be found in Mitsubishi Electric's security advisories:
- No fix availablecisco_csaf
No remediation is available at this time.
- No fix availableMcentercisa_csaf_ot
Currently no fix is available
- No fix availableSCALANCE X-200RNA switch familycisa_csaf_ot
Currently no fix is available
- No fix availableSIMATIC RTLS Locating Manager (6GT2780-0DA00)cisa_csaf_ot
Currently no fix is available
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 5.9–9.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (8)
Public proof-of-concept and weaponised exploit code.
- attilaszia/cve-2022-3602cve-2022-3602 pocPoC · poc_in_github
- colmmacc/CVE-2022-3602colmmacc/CVE-2022-3602PoC · poc_in_github
affected products (106)
Products and version ranges known to be affected.
advisories (15)
Vendor and ecosystem advisories describing this.
- SSA-408105SSA-408105: Buffer Overflow Vulnerabilities in OpenSSL 3.0 Affecting Siemens Products2022-12-13csaf · siemens_psirtDE
The openSSL component, versions 3.0.0 through 3.0.6, contains two buffer overflow vulnerabilities (CVE-2022-3602, CVE-2022-3786) in the X.509 certificate verification [0]. They could allow an attacker to create a denial of service condition or execute arbitrary code on a vulnerable TLS server (if the server requests client certificate authentication), or on a vulnerable TLS client. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available. [0] https://www.openssl.org/news/secadv/20221101.txt
- WID-SEC-W-2022-1922OpenSSL: Mehrere SchwachstellenDeutsch2022-11-01csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in OpenSSL ausnutzen, um einen Denial of Service Zustand herbeizuführen und potenziell um beliebigen Programmcode auszuführen.
- WID-SEC-W-2023-0561Xerox FreeFlow Print Server: Mehrere SchwachstellenDeutsch2023-03-02csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität des Systems zu gefährden.
- WID-SEC-W-2023-1969HPE Fabric OS: Mehrere Schwachstellen ermöglichen PrivilegieneskalationDeutsch2023-08-06csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in HPE Fabric OS für HPE Fibre Channel und SAN Switches ausnutzen, um seine Privilegien zu erhöhen, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.
- cisco-sa-openssl-W9sdCc2aVulnerabilities in OpenSSL Affecting Cisco Products: November 20222022-10-28csaf · cisco_csafUS
On November 1, 2022, the OpenSSL Project announced the following vulnerabilities: CVE-2022-3602 - X.509 Email Address 4-byte Buffer Overflow CVE-2022-3786 - X.509 Email Address Variable Length Buffer Overflow For a description of these vulnerabilities, see OpenSSL Security Advisory [Nov 1 2022] ["https://www.openssl.org/news/secadv/20221101.txt"]. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-W9sdCc2a ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-W9sdCc2a"]
- GHSA-8rwr-x37p-mx23X.509 Email Address 4-byte Buffer Overflow2022-11-01ghsa · osvUS
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.
- ICSA-22-349-09Siemens Products affected by OpenSSL 3.02022-12-13icsa · cisa_csaf_otUS
The openSSL component, versions 3.0.0 through 3.0.6, contains two buffer overflow vulnerabilities (CVE-2022-3602, CVE-2022-3786) in the X.509 certificate verification [0]. They could allow an attacker to create a denial of service condition or execute arbitrary code on a vulnerable TLS server (if the server requests client certificate authentication), or on a vulnerable TLS client. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available. [0] https://www.openssl.org/news/secadv/20221101.txt
- ICSA-22-349-10Siemens APOGEE/TALON Field Panels2022-12-15icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker to hijack existing sessions or spoof future sessions.
- ICSA-22-349-12Siemens Parasolid2022-12-13icsa · cisa_csaf_otUS
The openSSL component, versions 3.0.0 through 3.0.6, contains two buffer overflow vulnerabilities (CVE-2022-3602, CVE-2022-3786) in the X.509 certificate verification [0]. They could allow an attacker to create a denial of service condition or execute arbitrary code on a vulnerable TLS server (if the server requests client certificate authentication), or on a vulnerable TLS client. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available. [0] https://www.openssl.org/news/secadv/20221101.txt
- ICSA-23-005-03Hitachi Energy Lumada Asset Performance Management2023-01-05icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could cause a denial-of-service condition or unauthorized remote arbitrary code execution.
- ICSA-23-019-01Hitachi Energy PCU4002023-01-19icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could result in a denial-of-service condition on both the logging function of the device and its associated server.
- ICSA-23-229-01ICONICS and Mitsubishi Electric Products2023-08-17icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could result in information disclosure, denial-of-service, or remote code execution.
- BIT-node-2022-3602X.509 Email Address 4-byte Buffer Overflow2024-03-06vendor · osvUS
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6).
- BIT-node-min-2022-3602X.509 Email Address 4-byte Buffer Overflow2024-12-16vendor · osvUS
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6).
- RUSTSEC-2022-0064X.509 Email Address 4-byte Buffer Overflow2022-11-01vendor · osvUS
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.
also known as (8)
Other names and identifiers for this entity.
- CNNVD-202210-2605cnnvd
- EUVD-2022-7287enisa_euvd
- BDU:2022-06608fstec_bdu
- GHSA-8rwr-x37p-mx23enisa_euvd
- BIT-node-2022-3602osv
- BIT-node-min-2022-3602osv
- GHSA-8rwr-x37p-mx23osv
- RUSTSEC-2022-0064osv
sources
Which sources assert this record, and when.
references (138)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2022/11/01/15cnnvd
- http://www.openwall.com/lists/oss-security/2022/11/01/16cnnvd
- http://www.openwall.com/lists/oss-security/2022/11/01/17cnnvd
- http://www.openwall.com/lists/oss-security/2022/11/01/18cnnvd
- http://www.openwall.com/lists/oss-security/2022/11/01/19cnnvd
- http://www.openwall.com/lists/oss-security/2022/11/01/20cnnvd
- http://www.openwall.com/lists/oss-security/2022/11/01/21cnnvd
- http://www.openwall.com/lists/oss-security/2022/11/01/24cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan