Over-Hyped OpenSSL Vulnerability November 2022
161There was an announcement that OpenSSL 3.0.7 was due to be released on 1st November 2022 and that it would contain a security-fix rated at Critical.
This was subsequently over-hyped by the Infosec community, and the vulnerability was downgraded to High prior to the patch release.
Users of OpenSSL 3.0.0 to 3.0.6 should apply updates at your convenience.
The vulnerability does not affect older releases of OpenSSL.
Vulnerabilities Patched:
X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602)
X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786)
Sources:
https://mta.openssl.org/pipermail/openssl-announce/2022-October/000238.html
https://www.cisa.gov/uscert/ncas/alerts/TA14-098A
https://www.globalsign.com/en/blog/urgent-patch-openssl-november-1-avoid-critical-security-vulnerability
https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/new-openssl-v3-vulnerability-prepare-with-microsoft-defender-for/ba-p/3666487
https://isc.sans.edu/forums/diary/Upcoming Critical OpenSSL Vulnerability What will be Affected/29192
https://www.openssl.org/news/secadv/20221101.txt
https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/
Like my channel? Please help support it:
Paypal: https://www.paypal.me/quidsup
Follow me on Social Media
Twitter: https://twitter.com/quidsup
MeWe: https://mewe.com/i/quidsup
Minds: https://minds.com/quidsup
#OpenSSL
#CyberSecurity
#OverHyped
#QuidsupLinux