Lucene search

[email protected]CVE-2022-1473

HistoryMay 03, 2022 - 4:15 p.m.

CVE-2022-1473

2022-05-0316:15:18

CWE-459

[email protected]

web.nvd.nist.gov

147

cve-2022-1473

openssl_lh_flush

memory occupation bug

denial of service

openssl 3.0.

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.2%

JSON

The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).

Affected configurations

NVD

Node

opensslopensslRange3.0.0–3.0.3

Node

netappactive_iq_unified_managerMatch-vsphere

netappclustered_data_ontapMatch-

netappclustered_data_ontap_antivirus_connectorMatch-

netappsantricity_smi-s_providerMatch-

netappsmi-s_providerMatch-

netappsnapmanagerMatch-hyper-v

netappsolidfire\,_enterprise_sds_\&_hci_storage_nodeMatch-

netappsolidfire_\&_hci_management_nodeMatch-

Node

netappa700s_firmwareMatch-

AND

netappa700sMatch-

Node

netapph300s_firmwareMatch-

AND

netapph300sMatch-

Node

netapph500s_firmwareMatch-

AND

netapph500sMatch-

Node

netapph700s_firmwareMatch-

AND

netapph700sMatch-

Node

netapph300e_firmwareMatch-

AND

netapph300eMatch-

Node

netapph500e_firmwareMatch-

AND

netapph500eMatch-

Node

netapph700e_firmwareMatch-

AND

netapph700eMatch-

Node

netapph410s_firmwareMatch-

AND

netapph410sMatch-

Node

netappaff_8300_firmwareMatch-

AND

netappaff_8300Match-

Node

netappfas_8300_firmwareMatch-

AND

netappfas_8300Match-

Node

netappaff_8700_firmwareMatch-

AND

netappaff_8700Match-

Node

netappfas_8700_firmwareMatch-

AND

netappfas_8700Match-

Node

netappaff_a400_firmwareMatch-

AND

netappaff_a400Match-

Node

netappfabric-attached_storage_a400_firmwareMatch-

AND

netappfabric-attached_storage_a400Match-

Node

netappa250_firmwareMatch-

AND

netappa250Match-

Node

netappaff_500f_firmwareMatch-

AND

netappaff_500fMatch-

Node

netappfas_500f_firmwareMatch-

AND

netappfas_500fMatch-

CPENameOperatorVersion
openssl:opensslopenssllt3.0.3

CPE	Name	Operator	Version
openssl:openssl	openssl	lt	3.0.3

CNA Affected

[
  {
    "vendor": "OpenSSL",
    "product": "OpenSSL",
    "versions": [
      {
        "version": "Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2)",
        "status": "affected"
      }
    ]
  }
]