102 matches found
Awareness and guidance related to OpenSSL 3.0 - 3.0.6 risk (CVE-2022-3786 and CVE-2202-3602)
Summary Summary Microsoft is aware and actively addressing the impact associated with the recent OpenSSL vulnerabilities announced on October 25th 2022, fixed in version 3.0.7. As part of our standard processes, we are rolling out fixes for impacted services. Any customer action that is required...
AlmaLinux 9 : openssl (ALSA-2022:7288)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:7288 advisory. - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate...
FreeBSD : OpenSSL -- Buffer overflows in Email verification (0844671c-5a09-11ed-856e-d4c9ef517024)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 0844671c-5a09-11ed-856e-d4c9ef517024 advisory. - A buffer overrun can be triggered in X.509 certificate verification, specifically in name...
Oracle Linux 9 : openssl (ELSA-2022-7288)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-7288 advisory. - CVE-2022-3602: X.509 Email Address Buffer Overflow - running tests Resolves: CVE-2022-3602 Tenable has extracted the preceding description block...
RHEL 9 : openssl (RHSA-2022:7288)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7288 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full strength...
GLSA-202211-01 : OpenSSL: Multiple Vulnerabilities
The remote host is affected by the vulnerability described in GLSA-202211-01 OpenSSL: Multiple Vulnerabilities - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and...
SUSE: Security Advisory (SUSE-SU-2022:3843-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Amazon Linux 2022 : openssl, openssl-devel, openssl-libs (ALAS2022-2022-157)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-157 advisory. Two issues were found in OpenSSL 3.0. The first being a stack based buffer overflow, which is possible by sending an X.509 certificate with a specially crafted email address field. In the...
SonicWall OpenSSL Version 3.x Security Advisory
This advisory is intended to cover the following OpenSSL Vulnerabilities CVE-2022-3358 - Using a Custom Cipher with NIDundef may lead to NULL encryptionFixed in OpenSSL 3.0.6 Affected OpenSSL Versions 3.x, 3.0.0-3.0.5.More vulnerability details are available here...
CVE-2022-3786 vulnerabilities
Vulnerabilities for packages: openssl...
CVE-2022-3786 vulnerabilities
Vulnerabilities for packages: openssl...
CVE-2022-3786
creationtimestamp| type| source ---|---|--- 2022-11-01 17:28:35+00:00| seen| https://t.me/thehackernews/2723 2022-11-01 17:42:03+00:00| seen| https://t.me/ctinow/72672 2022-11-01 18:14:16+00:00| seen| Telegram/BvLKt3rLrvV1MavTWtzUjCGDDZdoZfIDa5boheIt5lY5uHc 2022-11-01 19:15:11+00:00| seen|...
SUSE-SU-2022:3843-1 Security update for openssl-3
This update for openssl-3 fixes the following issues: - CVE-2022-3358: Fixed vulnerability where a custom cipher passed to EVPCipherInit could lead into NULL encryption being unexpectedly used bsc1204226. - CVE-2022-3602: Fixed a buffer overflow in the X.509 email address. bsc1204714 -...
OpenSSL Releases Security Update
OpenSSL has released a security advisory to address two vulnerabilities, CVE-2022-3602 and CVE-2022-3786, affecting OpenSSL versions 3.0.0 through 3.0.6. Both CVE-2022-3602 and CVE-2022-3786 can cause a denial of service. According to OpenSSL, a cyber threat actor leveraging CVE-2022-3786, "can...
OpenSSL -- Buffer overflows in Email verification
The OpenSSL project reports: X.509 Email Address 4-byte Buffer Overflow CVE-2022-3602 High: A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. X.509 Email Address Variable Length Buffer Overflow CVE-2022-3786 High: A buffer overrun can b...
OpenSSL 3.0.0 to 3.0.6 decodes some punycode email addresses in X.509 certificates improperly
Overview Two buffer overflow vulnerabilities were discovered in OpenSSL versions 3.0.0 through 3.0.6. These vulnerabilities were introduced in version 3.0.0 with the inclusion of support for punycode email address parsing for X.509 certificates. OpenSSL's assessment of the severity of the...
CVE-2022-3786
OpenSSL CVE-2022-3602 and CVE-2022-3786 describe buffer overflows in X.509 name-constraint processing triggered by crafted email addresses in certificates, potentially crashing the TLS client/server and, in some scenarios, enabling remote code execution. Documents confirm the issues affect OpenSS...
OpenSSL 3.0.0 < 3.0.7 Multiple Vulnerabilities
The version of OpenSSL installed on the remote host is prior to 3.0.7. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.0.7 advisory. - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs...
OpenSSL vulnerabilities: Everything you need to know
On November 1st, 2022, the OpenSSL Project disclosed High severity vulnerabilities CVE-2022-3786 and CVE-2022-3602, affecting deployments of OpenSSL 3.0.0–3.0.6. Learn how to effectively manage your organization's patching efforts...