Description
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenSSL | OpenSSL | Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6) | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssl | 3.0.7-1 | — |
| Debian 13 | openssl | 3.0.7-1 | — |
| Debian 12 | openssl | 3.0.7-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | openssl | 3.0.2-0ubuntu1.7 | USN-5710-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | openssl +3 | 1:3.0.1-43.el9_0 | RHSA-2022:7288 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | openssl +3 | 1:3.0.1-43.el9_0 | ALSA-2022:7288 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | openssl | 1:3.0.1-43.el9_0 | RLSA-2022:7288 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | openssl-3 | 3.0.1-150400.4.11.1 | SUSE-SU-2022:3843-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cargo-audit-advisory-db | 20221102-1.1 | openSUSE-SU-2024:12469-1 |
| openSUSE Tumbleweed | openssl-3 | 3.0.7-1.1 | openSUSE-SU-2024:12475-1 |
| openSUSE Tumbleweed | python-cryptography | 38.0.3-1.1 | openSUSE-SU-2025:14739-1, openSUSE-SU-2024:12480-1, openSUSE-SU-2024:12479-1 |
| openSUSE Tumbleweed | python-cryptography-vectors | 44.0.0-1.1 | openSUSE-SU-2025:14740-1 |
| openSUSE Tumbleweed | python-mitmproxy | 11.1.2-1.1 | openSUSE-SU-2025:14762-1 |
| openSUSE Leap 15.4 | openssl-3 | 3.0.1-150400.4.11.1 | SUSE-SU-2022:3843-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | nodejs | 18.12.1-r0 | — |
| Alpine v3.24 | openssl | 3.0.7-r0 | — |
| Alpine v3.23 | nodejs | 18.12.1-r0 | — |
| Alpine v3.23 | openssl | 3.0.7-r0 | — |
| Alpine v3.22 | nodejs | 18.12.1-r0 | — |
| Alpine v3.22 | openssl | 3.0.7-r0 | — |
| Alpine v3.21 | nodejs | 18.12.1-r0 | — |
| Alpine v3.21 | openssl | 3.0.7-r0 | — |
| Alpine v3.20 | nodejs | 18.12.1-r0 | — |
| Alpine v3.20 | openssl | 3.0.7-r0 | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | nodejs | 18.12.1-r0 | — |
| Alpine v3.19 | openssl | 3.0.7-r0 | — |
| Alpine v3.18 | nodejs | 18.12.1-r0 | — |
| Alpine v3.18 | openssl | 3.0.7-r0 | — |
| Alpine v3.17 | nodejs | 18.12.1-r0 | — |
| Alpine v3.17 | openssl | 3.0.7-r0 | — |
| Alpine v3.16 | openssl3 | 3.0.7-r0 | — |
| Alpine v3.15 | openssl3 | 3.0.7-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nodejs +4 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 |
| Amazon Linux 2023 | npm | 1:8.19.2-1.18.12.1.1.amzn2023.0.2 | ALAS2023-2023-084 |
| Amazon Linux 2023 | openssl +3 | 1:3.0.5-1.amzn2023.0.4 | ALAS2023-2023-051 |
| Amazon Linux 2023 | v8-devel | 2:10.2.154.15-1.18.12.1.1.amzn2023.0.2 | ALAS2023-2023-084 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | openssl +3 | 1:3.0.1-43.0.1.el9_0 | ELSA-2022-7288 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | openssl | 3.0.7-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 8 repositories
-
NCSC-NL/OpenSSL-2022 ★ 530 · Oct 28, 2022
Operational information regarding CVE-2022-3602 and CVE-2022-3786, two vulnerabilities in OpenSSL 3
-
colmmacc/CVE-2022-3602 ★ 171 · Oct 30, 2022
-
rbowes-r7/cve-2022-3602-and-cve-2022-3786-openssl-poc ★ 17 · Nov 2, 2022
-
eatscrayon/CVE-2022-3602-poc ★ 13 · Oct 31, 2022
-
cybersecurityworks553/CVE-2022-3602-and-CVE-2022-3786 ★ 4 · Nov 7, 2022
-
corelight/CVE-2022-3602 ★ 4 · Nov 3, 2022
Detects attempts at exploitation of CVE-2022-3602, a remote code execution vulnerability in OpenSSL v 3.0.0 through v.3.0.6
-
attilaszia/cve-2022-3602 ★ 3 · Nov 1, 2022
cve-2022-3602 poc
-
alicangnll/SpookySSL-Scanner ★ 1 · Nov 2, 2022
SpookySSL CVE-2022-3602 SSLv3 Scanner for Windows, Linux, macOS
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | openssl-src | >= 300.0.0, < 300.0.11 | 300.0.11 | GHSA-8rwr-x37p-mx23 |
Advisories 25
- ALSA-2022:7288 Important: openssl security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2022:7288 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- USN-5710-1 openssl vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- ICSA-22-349-09 Siemens Products affected by OpenSSL 3.0 CISA ICS & IT advisories · Apr 16, 2026
- SSA-408105 SSA-408105: Buffer Overflow Vulnerabilities in OpenSSL 3.0 Affecting Siemens Products Siemens ProductCERT · Apr 14, 2026
- RLSA-2022:7288 Important: openssl security update Rocky Linux Security Advisories · Feb 5, 2026
- openSUSE-SU-2024:12475-1 libopenssl-3-devel-3.0.7-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3843-1 Security update for openssl-3 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14740-1 python311-cryptography-vectors-44.0.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14762-1 python312-mitmproxy-11.1.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12469-1 cargo-audit-advisory-db-20221102-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12480-1 python310-cryptography-vectors-38.0.3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14739-1 python311-cryptography-44.0.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12479-1 python310-cryptography-38.0.3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ICSA-22-349-10 Siemens APOGEE/TALON Field Panels CISA ICS & IT advisories · May 6, 2025
- ICSA-22-349-12 Siemens Parasolid CISA ICS & IT advisories · May 6, 2025
- WID-SEC-2022-1922 OpenSSL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 5, 2025
- ICSA-23-229-01 ICONICS and Mitsubishi Electric Products CISA ICS & IT advisories · Aug 17, 2023
- WID-SEC-2023-1969 HPE Fabric OS: Mehrere Schwachstellen ermöglichen Privilegieneskalation BSI CERT-Bund (WID) · Aug 6, 2023
- WID-SEC-2023-0561 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 18, 2023
- ALAS2023-2023-051 Important: openssl security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 22, 2023
- ALAS2023-2023-084 Important: nodejs security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 22, 2023
- ICSA-23-019-01 Hitachi Energy PCU400 CISA ICS & IT advisories · Jan 19, 2023
- ICSA-23-005-03 Hitachi Energy Lumada Asset Performance Management CISA ICS & IT advisories · Jan 5, 2023
- ELSA-2022-7288 Important: openssl security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 1, 2022
References
- https://www.openssl.org/news/secadv/20221101.txt
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fe3b639dc19b325846f4f6801f2f4604f56e3de3
- [oss-security] 20221101 OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- [oss-security] 20221101 Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- 20221028 Vulnerabilities in OpenSSL Affecting Cisco Products: November 2022 vendor-advisory
- [oss-security] 20221101 Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- [oss-security] 20221101 Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- [oss-security] 20221101 Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- [oss-security] 20221101 Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- [oss-security] 20221101 Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- [oss-security] 20221102 Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- GLSA-202211-01 vendor-advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0023
- VU#794340 third-party-advisory
- FEDORA-2022-0f1d2e0537 vendor-advisory
- FEDORA-2022-502f096dce vendor-advisory
- [oss-security] 20221101 Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- [oss-security] 20221102 Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- [oss-security] 20221102 Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- [oss-security] 20221101 Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- [oss-security] 20221101 Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- [oss-security] 20221102 Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- [oss-security] 20221102 Re: Fwd: Node.js security updates for all active release lines, November 2022 mailing-list
- [oss-security] 20221102 Re: Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- http://packetstormsecurity.com/files/169687/OpenSSL-Security-Advisory-20221101.html
- [oss-security] 20221102 Re: Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- [oss-security] 20221102 Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- [oss-security] 20221102 Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- [oss-security] 20221102 Re: Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- [oss-security] 20221102 Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- https://security.netapp.com/advisory/ntap-20221102-0001/
- [oss-security] 20221102 Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- [oss-security] 20221102 Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- [oss-security] 20221103 Re: Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- [oss-security] 20221103 Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- [oss-security] 20221103 Re: Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- [oss-security] 20221103 Re: Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- [oss-security] 20221103 Re: Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- [oss-security] 20221103 Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list
- [oss-security] 20221103 Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) mailing-list