cyber.hendryadrian.com
Vulnerability & Exploit · wiz.io

OpenSSL 3 Vulnerabilities Could Enable Remote Code Execution Under Specific Conditions

· Original article ↗

Summary

OpenSSL flaws CVE-2022-3602 and CVE-2022-3786 affect versions 3.0.0 and later. Exploitation is constrained by specific certificate and configuration requirements; Wiz recommends upgrading to OpenSSL 3.0.7.

Key points

  • The vulnerabilities are buffer overflows in OpenSSL’s X.509 certificate verification punycode decoder.
  • Affected versions are OpenSSL 3.0.0 and later; OpenSSL 1.x is not affected.
  • Exploitation could enable remote code execution, but requires specific conditions. Servers must use mutual TLS and receive a specially crafted client certificate; clients must connect to an attacker-controlled server.
  • A public proof of concept was available that could crash a vulnerable system, but the article says it did not enable RCE.
  • Wiz reported that 1.5% of OpenSSL instances in its analyzed cloud environments used affected versions, although more than 75% of organizations had at least one impacted instance.
  • Wiz recommended upgrading to OpenSSL 3.0.7 and prioritizing exposed, mission-critical and high-privilege assets.

Article Details

Vulnerability Types
  • Buffer overflow
Severity
High
Affected Versions
  • OpenSSL 3.0.0 and above; upgrade to OpenSSL 3.0.7
Exploitation Status
unknown
Exploit Availability
public_poc
Patch Status
available

CVE

CVE-2022-3602TL;DR: OpenSSL Project released two new vulnerabilities, CVE-2022-3602 and CVE-2022-3786, which are less severe than previously announced. According to Wiz Research, these buffer overflow vulnerabilities are hard toCVE-2022-3786TL;DR: OpenSSL Project released two new vulnerabilities, CVE-2022-3602 and CVE-2022-3786, which are less severe than previously announced. According to Wiz Research, these buffer overflow vulnerabilities are hard to

People

Shir TamariWiz Head of Research; presented a video summary of the vulnerabilities.

Vendors

OpenSSL ProjectTL;DR: OpenSSL Project released two new vulnerabilities, CVE-2022-3602 and CVE-2022-3786, which are less severe than previously announced. According to Wiz Research, these buffer overflow vulnerabilities are hard to

Products

OpenSSLTL;DR: OpenSSL Project released two new vulnerabilities, CVE-2022-3602 and CVE-2022-3786, which are less severe than previously announced. According to Wiz Research, these buffer overflow vulnerabilities are hard toWiz Security Graphcontainers, serverless functions, and even virtual appliances. Additionally, customers can use the Wiz Security Graph to focus remediation efforts on the workloads that face the greatest risk (e.g. workloads that areWiz Threat CenterUse Wiz Threat Center for a prioritized list of impacted assets

Related Articles