CVE-2022-3602 is a high-severity buffer overrun vulnerability affecting OpenSSL versions 3.0.0 to 3.0.6. It occurs in X.509 certificate verification, specifically in name constraint checking, and can be triggered by a malicious email address. This vulnerability could result in a crash (causing a denial of service) or potentially remote code execution, although many platforms implement stack overflow protections that can mitigate the risk. Users are encouraged to upgrade to OpenSSL 3.0.7 to address this issue. The vulnerability affects a wide range of systems that use OpenSSL for secure communication.

How do I know if I'm affected?

If you're using OpenSSL versions 3.0.0 to 3.0.6, you might be affected by the CVE-2022-3602 vulnerability. This issue is related to a buffer overrun in X.509 certificate verification, specifically in name constraint checking. An attacker can trigger this vulnerability by crafting a malicious email address, which could lead to a crash (denial of service) or potentially remote code execution. However, many platforms have stack overflow protections that can help mitigate the risk.

What should I do if I'm affected?

If you're affected by the CVE-2022-3602 vulnerability, it's important to take action to protect your system. To do this, simply upgrade to OpenSSL 3.0.7 if you're using OpenSSL 3.0. Users of OpenSSL 1.1.1 and 1.0.2 are not affected and don't need to take any action. Upgrading will help prevent potential crashes or remote code execution risks.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2022-3602 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This high-severity issue involves a buffer overrun in X.509 certificate verification, specifically in name constraint checking. It can be triggered by a malicious email address, potentially causing a crash or remote code execution. The vulnerability affects OpenSSL versions 3.0.0 to 3.0.6, and the recommended action is to upgrade to OpenSSL 3.0.7.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-787 in X.509 certificate verification, which can lead to crashes or potential remote code execution. Upgrading to OpenSSL 3.0.7 is recommended.

For more details

CVE-2022-3602 is a high-severity buffer overrun vulnerability affecting OpenSSL versions 3.0.0 to 3.0.6. Upgrading to OpenSSL 3.0.7 is recommended to mitigate the risk of crashes or potential remote code execution. For more information about the vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• OpenSSL Security Advisory 20221101 ≈ Packet Storm

• oss-security - OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786)

• oss-security - Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786)

• oss-security - Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786)