OpenSSL: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• High 7.5
  CVE-2022-3602 Public exploit EPSS 91%

  X.509 Email Address 4-byte Buffer Overflow

  A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the ap…

  OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine Wolfi crates.io
  Nov 1, 2022
• High 7.5
  CVE-2022-3786 Public exploit EPSS 92%

  X.509 Email Address Variable Length Buffer Overflow

  A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an appli…

  OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine Wolfi crates.io
  Nov 1, 2022

Revision history

1. 2025-01-05 #16

   Neue Updates von IBM aufgenommen

2. 2024-11-25 #15

   Neue Updates von Oracle Linux aufgenommen

3. 2024-06-04 #14

   Neue Updates von Oracle Linux aufgenommen

4. 2024-04-24 #13

   Neue Updates von Oracle Linux aufgenommen

5. 2024-01-22 #12

   Neue Updates von Amazon aufgenommen

6. 2023-08-13 #11

   Neue Updates von HP aufgenommen

7. 2023-08-08 #10

   Neue Updates von LENOVO und AMD aufgenommen

8. 2023-05-30 #9

   Neue Updates von IBM aufgenommen

9. 2023-01-24 #8

   Neue Updates von IBM aufgenommen

10. 2022-12-20 #7

    Neue Updates von SUSE aufgenommen

11. 2022-11-17 #6

    Neue Updates von Oracle Linux aufgenommen

12. 2022-11-10 #5

    Neue Updates aufgenommen

13. 2022-11-08 #4

    Neue Updates von Unify und Tenable aufgenommen

14. 2022-11-06 #3

    Neue Updates von IBM aufgenommen

15. 2022-11-02 #2

    Neue Updates von Tenable, Red Hat und NetApp aufgenommen

16. 2022-11-01 #1

    Initiale Fassung

References

• OpenSSL Security Advisory vom 2022-11-01
  https://www.openssl.org/news/secadv/20221101.txt
• Red Hat Security Advisory RHSA-2022:7288 vom 2022-11-01
  https://access.redhat.com/errata/RHSA-2022:7288
• Amazon Linux Security Advisory ALAS-2022-157 vom 2022-11-01
  https://alas.aws.amazon.com/AL2022/ALAS-2022-157.html
• Oracle Linux Security Advisory ELSA-2022-7288 vom 2022-11-01
  https://linux.oracle.com/errata/ELSA-2022-7288.html
• SUSE Security Update SUSE-SU-2022:3843-1 vom 2022-11-01
  https://lists.suse.com/pipermail/sle-security-updates/2022-November/012796.html
• Gentoo Linux Security Advisory GLSA-202211-01 vom 2022-11-01
  https://security.gentoo.org/glsa/202211-01
• Ubuntu Security Notice USN-5710-1 vom 2022-11-01
  https://ubuntu.com/security/notices/USN-5710-1
• Juniper Security Bulletin vom 2022-11-01
  https://supportportal.juniper.net/s/article/2022-11-Out-of-Cycle-Security-Bulletin-High-severity-security-issues-resolved-in-OpenSSL-3-0-7-CVE-2022-3602-CVE-2022-3786
• Cisco Security Advisory cisco-sa-openssl-W9sdCc2a vom 2022-11-01
  https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-W9sdCc2a
• PoC
  https://github.com/micr0sh0ft/certscare-openssl3-exploit
• Tenable Security Advisory TNS-2022-22 vom 2022-11-02
  https://www.cybersecurity-help.cz/vdb/SB2022110251
• Red Hat Security Advisory RHSA-2022:7384 vom 2022-11-03
  https://access.redhat.com/errata/RHSA-2022:7384
• Tenable Security Advisory TNS-2022-24 vom 2022-11-03
  https://www.tenable.com/security/tns-2022-24
• Tenable Security Advisory TNS-2022-22 vom 2022-11-02
  https://www.tenable.com/security/tns-2022-22
• Tenable Security Advisory TNS-2022-23 vom 2022-11-03
  https://www.tenable.com/security/tns-2022-23
• NetApp Security Advisory NTAP-20221102-0001 vom 2022-11-02
  https://security.netapp.com/advisory/ntap-20221102-0001/
• IBM Security Bulletin 6837195 vom 2022-11-05
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-advanced-message-security-on-ibm-i-platforms-is-affected-by-a-buffer-overflow-issue-in-openssl-cve-2022-3602-cve-2022-3786/
• node.js Security Release
  https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/
• Microsoft Leitfaden für Sicherheitsupdates vom 2022-11-02
  https://msrc.microsoft.com/update-guide
• Unify Security Advisory Report OBSO-2211-01 vom 2022-11-08
  https://networks.unify.com/security/advisories/OBSO-2211-01.pdf
• Tenable Security Advisory TNS-2022-25 vom 2022-11-08
  https://www.tenable.com/security/tns-2022-25
• Alcatel-Lucent Security Advisory
  https://app.conversation.al-enterprise.com/e/er?s=138097979&lid=16028
• SolarWinds Trust Center Security Advisories
  https://www.solarwinds.com/de/trust-center/security-advisories/cve-2022-3602-and-cve-2022-3786
• Oracle Linux Security Advisory ELSA-2022-10004 vom 2022-11-17
  https://linux.oracle.com/errata/ELSA-2022-10004.html
• SUSE Security Update SUSE-SU-2022:4586-1 vom 2022-12-20
  https://lists.suse.com/pipermail/sle-security-updates/2022-December/013293.html
• IBM Security Bulletin 6857295 vom 2023-01-24
  https://aix.software.ibm.com/aix/efixes/security/openssl_advisory37.asc
• IBM Security Bulletin 6999285 vom 2023-05-30
  https://www.ibm.com/support/pages/node/6999285
• Lenovo Security Advisory LEN-106015 vom 2023-08-09
  https://support.lenovo.com/us/en/product_security/LEN-106015
• AMD Security Bulletin AMD-SB-7001 vom 2023-08-09
  https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7001.html
• HPE Securi+y Bulletin
  https://support.hpe.com/hpesc/public/docDisplay?docId=emr_na-hpesbst04494en_us
• Amazon Linux Security Advisory ALAS-2023-286 vom 2024-01-23
  https://alas.aws.amazon.com/AL2022/ALAS-2023-286.html
• Oracle Linux Security Advisory ELSA-2024-12343 vom 2024-04-25
  https://linux.oracle.com/errata/ELSA-2024-12343.html
• Oracle Linux Security Advisory ELSA-2024-20865 vom 2024-04-25
  https://linux.oracle.com/errata/ELSA-2024-20865.html
• Oracle Linux Security Advisory ELSA-2024-23120 vom 2024-06-04
  https://linux.oracle.com/errata/ELSA-2024-23120.html
• Oracle Linux Security Advisory ELSA-2024-12409 vom 2024-06-04
  https://linux.oracle.com/errata/ELSA-2024-12409.html
• Oracle Linux Security Advisory ELSA-2024-12408 vom 2024-06-05
  https://linux.oracle.com/errata/ELSA-2024-12408.html
• Oracle Linux Security Advisory ELSA-2024-12842 vom 2024-11-25
  https://linux.oracle.com/errata/ELSA-2024-12842.html
• IBM Security Bulletin 7180282 vom 2025-01-04
  https://www.ibm.com/support/pages/node/7180282