Description
OpenSSL versions 3.0.0 to 3.0.6 are vulnerable to two buffer overrun vulnerabilities that can be triggered in X.509 certificate verification,
specifically in name constraint checking.
The vulnerabilities occur
after certificate chain signature verification and requires either a
CA to have signed the malicious certificate or for the application to
continue certificate verification despite failure to construct a path
to a trusted issuer. An attacker can craft a malicious email address
to overflow four attacker-controlled bytes on the stack.
The vulnerabilities are:
- X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602)
- X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786)
Remediation
OpenSSL 3.0 users should upgrade to OpenSSL 3.0.7.
OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.