OpenSSL Outlines Two High Severity Vulnerabilities

Written by Michael Larabel in Linux Security on 1 November 2022 at 12:17 PM EDT. 17 Comments
LINUX SECURITY
Two high severity security vulnerabilities affecting OpenSSL were made public today, which were the issues that led to Fedora 37 being delayed to mid-November to allow the release images have mitigated OpenSSL packages.

The OpenSSL vulnerabilities made public today are an X.509 email address 4-byte buffer overflow (CVE-2022-3602) and an X.509 email address variable length buffer overflow (CVE-2022-3786).

Both vulnerabilities pertain to buffer overruns within the X.509 certificate verification. CVE-2022-3602 is the vulnerability originally deemed "critical" and what led to the delayed Fedora 37 and the like. However, on further analysis they decided to downgrade it to "high" severity.


OpenSSL 3.0.x prior to OpenSSL 3.0.7 are affected by these vulnerabilities but not the older OpenSSL 1.x releases.

More details on these OpenSSL security vulnerabilities via OpenSSL.org. OpenSSL 3.0.7 is available with the fixes.
Related News
About The Author
Michael Larabel

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via MichaelLarabel.com.

Popular News This Week