OpenSSL 3.0.7 fixes X.509 email address buffer overflows (openssl.org)

Article summary

OpenSSL 3.0.7 has been released to fix two buffer overflows in punycode decoding functions, specifically in X.509 certificate verification. The vulnerabilities, CVE-2022-3786 and CVE-2022-3602, were initially assessed as CRITICAL but later downgraded to HIGH after further testing. The issues can be triggered by connecting to a malicious server or by a CA signing a malicious certificate. Users of OpenSSL 3.0.0-3.0.6 are encouraged to upgrade to 3.0.7 as soon as possible.

Main themes

• OpenSSL vulnerability
• buffer overflow
• X.509 certificate verification
• patching prioritization
• vulnerability severity
• exploitation risk

What commenters say

• The severity of vulnerabilities should not be downgraded based on limited testing, as it may still be possible to exploit them in certain situations.
• Patching vulnerabilities is not always a straightforward process and requires consideration of resource allocation and prioritization.
• The distinction between CRITICAL and HIGH severity vulnerabilities is important for determining the urgency of patching, but may not always be clear-cut.
• In some cases, patching a HIGH severity vulnerability may not be necessary if the system is not vulnerable to exploitation, such as when only trusted certificates are used.
• The OpenSSL team's decision to downgrade the severity of the vulnerabilities was reasonable based on further testing and analysis.
• The potential for a vulnerability to be exploited in a larger chain of bugs is a valid reason to patch, even if the individual vulnerability is not critical.
• The categorization of vulnerabilities as CRITICAL or HIGH can impact the response and prioritization of patching, with some arguing that it is not always a clear or useful distinction.