CVE-2022-3602: OpenSSL3 CVE-2022-3602 CVE-2022-3786 vulnerabilities

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution.

All versions of the v18.x and v19.x releases lines.

— Node.Js

As per upstream report:

A buffer overrun can be triggered by sending an X.509 certificate with a specially crafted email address field to a vulnerable client or server. This can result in an overflow of four attacker-controlled bytes on the stack. This could result in a crash (causing a denial of service) or possibly result in remote code execution.

The most common situation where this can be triggered is when a server requests client authentication after a malicious client connects. The converse of a client connecting to a malicious server is also believed to be vulnerable in the same manner.

OpenSSL versions 3.0.0 to 3.0.6 are vulnerable to this attack.

OpenSSL 3.0 users should upgrade to OpenSSL 3.0.7.

OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.

— Red Hat

OpenSSL is vulnerable to a stack-based buffer overflow, caused by improper bounds checking during X.509 certificate verification. By using a specially-crafted email address, a remote attacker could overflow a buffer and execute arbitrary code or cause the application to crash.

— IBM