Skip to content
OpenAdvisories
High ELSA-2022-7288 2 CVEs

Important: openssl security update (Oracle Linux 9)

Published Nov 1, 2022 · Updated Nov 1, 2022

Ecosystem: Oracle Linux

Summary

[3.0.1-43.0.1]
- Replace upstream references [Orabug: 34340177]

[1:3.0.1-43]
- CVE-2022-3602: X.509 Email Address Buffer Overflow - running tests
Resolves: CVE-2022-3602

[1:3.0.1-42]
- CVE-2022-3602: X.509 Email Address Buffer Overflow
Resolves: CVE-2022-3602

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 9 openssl 1:3.0.1-43.0.1.el9_0
Oracle Linux · 9 openssl-devel 1:3.0.1-43.0.1.el9_0
Oracle Linux · 9 openssl-libs 1:3.0.1-43.0.1.el9_0
Oracle Linux · 9 openssl-perl 1:3.0.1-43.0.1.el9_0

Vulnerabilities 2

  • High 7.5
    CVE-2022-3602 Public exploit EPSS 91%

    X.509 Email Address 4-byte Buffer Overflow

    A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the ap…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine Wolfi crates.io
  • High 7.5
    CVE-2022-3786 Public exploit EPSS 92%

    X.509 Email Address Variable Length Buffer Overflow

    A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an appli…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine Wolfi crates.io