CVE-2022-3996: X.509 Policy Constraints Double Locking
First published: Tue Dec 13 2022(Updated: )
If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy processing being enabled on a publicly facing server is not considered to be a common setup. Policy processing is enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. Update (31 March 2023): The description of the policy processing enablement was corrected based on CVE-2023-0466.
Credit: openssl-security@openssl.org openssl-security@openssl.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| rust/openssl-src | >=300.0.0<300.0.12 | 300.0.12 |
| OpenSSL libcrypto | >=3.0.0<=3.0.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-3996?
The severity of CVE-2022-3996 is high with a severity value of 7.5.
How does CVE-2022-3996 affect OpenSSL?
CVE-2022-3996 affects OpenSSL versions between 3.0.0 and 3.0.7.
What can happen if an X.509 certificate contains a malformed policy constraint and policy processing is enabled?
If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, it can result in a denial of service when the affected process hangs.
How can I mitigate the vulnerability in CVE-2022-3996?
To mitigate the vulnerability in CVE-2022-3996, ensure you are using OpenSSL version 3.0.8 or later, as the issue is fixed in that version.
Where can I find more information about CVE-2022-3996?
You can find more information about CVE-2022-3996 in the references provided: [link to GitHub commit](https://github.com/openssl/openssl/commit/7725e7bfe6f2ce8146b6552b44e0d226be7638e7), [link to OpenSSL advisory](https://www.openssl.org/news/secadv/20221213.txt).
- agent/type
- agent/remedy
- agent/weakness
- agent/title
- agent/first-publish-date
- agent/author
- agent/severity
- agent/references
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-vr8j-hgmm-jh9r
- alias/CVE-2022-3996
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/github-advisory
- agent/softwarecombine
- agent/trending
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-cve
- collector/nvd-index
- package-manager/rust
- vendor/openssl
- canonical/openssl libcrypto
- version/openssl libcrypto/3.0.0
- version/openssl libcrypto/3.0.7