OpenSSL has patched two high severity vulnerabilities
OpenSSL has released two high severity vulnerabilities within the open source OpenSSL library.
The both vulnerabilities CVE-2022-3602 and CVE-2022-3786 require a malicious X.509 certificate that has been signed by a valid certificate authority.
The first vulnerability CVE-2022-3602 – could cause a denial of service by allowing the bytes containing the character “.” (decimal 46) to be entered on the stack.
The second one CVE-2022-3786 – could cause a denial of service by allowing the attacker to craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the “.” character (decimal 46) on the stack.
Affected version: OpenSSL versions 3.0.0 to 3.0.6.
Mitigation: OpenSSL 3.0 users should upgrade to OpenSSL 3.0.7.
Bangaly Koita is a Cyber Security Analyst and researcher working for Radarcs Cyber Security in Vienna-Austria. As a passionate in cyber security, he writes articles to share his knowledge and experience to the vast community of IT but in general Cyber Security.
