Overview

Two buffer overflow vulnerabilities were discovered in OpenSSL versions 3.0.0 through 3.0.6. These vulnerabilities were introduced in version 3.0.0 with the inclusion of support for punycode email address parsing for X.509 certificates. OpenSSL's assessment of the severity of the vulnerabilities has reduced from CRITICAL to HIGH, and OpenSSL 3.0.7 addresses the issues.

Description

Two buffer overflows have been reported in the OpenSSL 3.0.x branch prior to version 3.0.7 that, when exploited, may lead to denial of services or, in some cases, remote code execution in the vulnerable target environment. OpenSSL client and server implementations that use the vulnerable libraries are affected. The server implementation also requires that TLS client authentication is enabled in order to attack, and potentially exploit, a vulnerable target. OpenSSL provides details:

* Fixed two buffer overflows in punycode decoding functions.

   A buffer overrun can be triggered in X.509 certificate verification,
   specifically in name constraint checking. Note that this occurs after
   certificate chain signature verification and requires either a CA to
   have signed the malicious certificate or for the application to continue
   certificate verification despite failure to construct a path to a trusted
   issuer.

   In a TLS client, this can be triggered by connecting to a malicious
   server.  In a TLS server, this can be triggered if the server requests
   client authentication and a malicious client connects.

   An attacker can craft a malicious email address to overflow
   an arbitrary number of bytes containing the `.`  character (decimal 46)
   on the stack.  This buffer overflow could result in a crash (causing a
   denial of service).
   ([CVE-2022-3786])

   An attacker can craft a malicious email address to overflow four
   attacker-controlled bytes on the stack.  This buffer overflow could
   result in a crash (causing a denial of service) or potentially remote code
   execution depending on stack layout for any given platform/compiler.
   ([CVE-2022-3602])

OpenSSL versions 1.1.1 and 1.0.2 are not affected.

CERT/CC is unaware of any exploitation of this vulnerability at this time.

Impact

Successful exploitation could lead to denial of service or remote execution of arbitrary code in the target environment.

Solution

Any services depending on versions of OpenSSL 3.0.x prior to OpenSSL 3.0.7 should be upgraded to version 3.0.7 or later. Operators may also consider temporarily disabling TLS client authentication until applying an update.

Acknowledgements

Thanks to OpenSSL for coordinating and remediating the vulnerability. Polar Bear is credited as having discovered CVE--2022-3602. Viktor Dukhovni is reported as the source of CVE-2022-3786.

This document was written by Kevin Stephens, Eric Hatleback, Vijay Sarvepalli, and Jeffrey S. Havrilla.

Vendor Information

794340

Filter by status:

Filter by content: Additional information available

Sort by:

Expand all

Adobe Affected

Notified: 2022-10-31 Updated: 2022-11-09

Statement Date: November 07, 2022

CVE-2022-3602

Affected

Vendor Statement:

Adobe is aware of the OpenSSL 3.0.7 security update that was released on November 1st, 2022. We will remediate within our standard vulnerability timelines.

CVE-2022-3786

Unknown

Vendor Statement:

Adobe is aware of the OpenSSL 3.0.7 security update that was released on November 1st, 2022. We will remediate within our standard vulnerability timelines.

Barracuda Networks Affected

Notified: 2022-10-31 Updated: 2022-11-09

Statement Date: November 07, 2022

CVE-2022-3602

Affected

Vendor Statement:

Barracuda Networks has completed patching for all our products affected by the CVEs: CVE-2022-3602 and CVE-2022-3786. For our SaaS products no action is required by our customers. For our appliance customers, please check for the latest firmware updates or Hotfixes available for your specific product. Please note that not all our products were impacted.

References:

https://www.barracuda.com/company/legal/barracudas-response-to-openssl-security-advisory

CVE-2022-3786

Affected

Vendor Statement:

References:

https://www.barracuda.com/company/legal/barracudas-response-to-openssl-security-advisory

Vendor Statement

Barracuda Networks has completed patching for all our products affected by the CVEs: CVE-2022-3602 and CVE-2022-3786.

References

https://www.barracuda.com/company/legal/barracudas-response-to-openssl-security-advisory

Citrix Affected

Notified: 2022-10-31 Updated: 2022-12-07

Statement Date: December 02, 2022

CVE-2022-3602

Affected

Vendor Statement:

Citrix is aware of the vulnerabilities (CVE-2022-3602, CVE-2022-3786) that impact OpenSSL versions 3.0.0 to 3.0.6. Citrix continues to investigate any potential impact on Citrix-managed cloud services. If, as the investigation continues, any Citrix-managed services are found to be affected by this issue, Citrix will take immediate action to remediate the problem. Customers using Citrix-managed cloud services do not need to take any action.

References:

https://support.citrix.com/article/CTX473026/impact-of-open-ssl-30-vulnerabilities-cve20223602-cve20223786-on-citrix-products

CVE-2022-3786

Affected

Vendor Statement:

References:

https://support.citrix.com/article/CTX473026/impact-of-open-ssl-30-vulnerabilities-cve20223602-cve20223786-on-citrix-products

Vendor Statement

References

https://support.citrix.com/article/CTX473026/impact-of-open-ssl-30-vulnerabilities-cve20223602-cve20223786-on-citrix-products

Crestron Electronics Affected

Notified: 2022-10-31 Updated: 2022-11-19

Statement Date: November 17, 2022

CVE-2022-3602

Affected

CVE-2022-3786

Affected

Vendor Statement:

Only Crestron's UC Engine was vulnerable. This vulnerability affects the UC-Engine product line starting with version 1.00.22.766. The issue is resolved 1.00.22.784. See https://www.crestron.com/Security/Security_Advisories for details.

Vendor Statement

Only Crestron's UC Engine was vulnerable.

This vulnerability affects the UC-Engine product line starting with version 1.00.22.766. The issue is resolved 1.00.22.784.

See https://www.crestron.com/Security/Security_Advisories for details.

Digi International Affected

Notified: 2022-10-31 Updated: 2022-12-07

Statement Date: December 05, 2022

CVE-2022-3602

Affected

Vendor Statement:

Digi International is looking into the new Critical OpenSSL vulnerability, CVE-2022-3786, and CVE-2022-3602. Currently, the EX50 and TX64 devices are vulnerable to CVE-2022-3786 and CVE-2022-3602. All other Digi Accelerated Linux (DAL) products are not affected. The EX50 and TX64 firmware will be updated to mitigate these vulnerabilities within the next patch release. Digi Embedded Yocto version 4.0-r1 is currently vulnerable to CVE-2022-3786 and CVE-2022-3602 and will be updated to mitigate those vulnerabilities within the next patch release. All other versions of DEY are not affected. Other OpenSSL libraries are also being looked at as well. The libraries found not up to date will also receive patches.

CVE-2022-3786

Affected

Vendor Statement:

FreeRADIUS Affected

Notified: 2022-10-31 Updated: 2022-11-01

Statement Date: October 31, 2022

CVE-2022-3602

Affected

CVE-2022-3786

Unknown

Vendor Statement

As FreeRADIUS uses OpenSSL along with TLS-based EAP methods, and RADIUS/TLS, we are likely affected by this issue.

Sites which are not using RADIUS/TLS and are not using TLS-based EAP methods (EAP-TLS, TTLS, PEAP) are not affected. We still recommend upgrading OpenSSL to a non-vulnerable version.

FreeRADIUS version 3.0.26 and later added support for OpenSSL 3. Any site which has built the server with OpenSSL 3 is likely affected. Some vendors of OS distributions may have patched earlier versions of FreeRADIUS to support OpenSSL 3. We suggest asking those vendors for updates.

Versions of FreeRADIUS which are built against OpenSSL 1.x are not affected by this issue.

We suggest sites using OpenSSL 3 upgrade to OpenSSL 3.0.7 as soon as it is available. There is no need to upgrade FreeRADIUS.

Fujitsu Affected

Notified: 2022-10-31 Updated: 2022-11-28

Statement Date: November 23, 2022

CVE-2022-3602

Affected

CVE-2022-3786

This vulnerability only exists in the v10.97.2 version of the ICONICS Suite product, and is only a threat if the BACnet/SC communications is being used. BACnet/SC was a new optional feature in the v10.97.2 release, not enabled by default, and provided as a "Beta" version within the release.

CVE-2022-3786

Affected

Vendor Statement:

Vendor Statement

These vulnerabilities only exists in the v10.97.2 version of the ICONICS Suite product, and are only a threat if the BACnet/SC communications is being used. BACnet/SC was a new optional feature in the v10.97.2 release, not enabled by default, and provided as a "Beta" version within the release. These vulnerabilities are addressed in the Critical Fixes Rollup 1 release for the v10.97.2 version of the ICONICS Suite product.

Illumos Affected

Notified: 2022-10-31 Updated: 2022-11-01

Statement Date: November 01, 2022

CVE-2022-3602

Affected

CVE-2022-3786

Unknown

Vendor Statement

OpenSSL is a distribution problem, so it does not directly affect illumos, but I'd like to include on behalf of as many distros as possible their OpenSSL 3.0.7 plans.

OmniOS: Should be ready for appropriate releases (r151040 and newer) by Tuesday Nov 1st.

SmartOS: Will be ready in the 20221103 biweekly release that cuts this week.

OpenIndiana: Does not ship OpenSSL 3.0.x yet, so unaffected.

Tribblix: Does not ship OpenSSL 3.0.x yet, so unaffected.

Dilos: Does not ship OpenSSL 3.0.x yet, so unaffected.

Joyent Affected

Notified: 2022-10-31 Updated: 2022-11-01

Statement Date: October 31, 2022

CVE-2022-3602

Affected

CVE-2022-3786

Unknown

Vendor Statement

We have not received a statement from the vendor.

Juniper Networks Affected

Notified: 2022-10-28 Updated: 2022-11-01

Statement Date: November 01, 2022

CVE-2022-3602

Affected

Vendor Statement:

Juniper Networks has published an official Juniper Security Advisory regarding the recent pair of HIGH severity OpenSSL vulnerabilities announced by the OpenSSL project team.

References:

Refer to https://kb.juniper.net/JSA69999 for more information.

CVE-2022-3786

Affected

Vendor Statement:

Juniper Networks has published an official Juniper Security Advisory regarding the recent pair of HIGH severity OpenSSL vulnerabilities announced by the OpenSSL project team.

References:

Refer to https://kb.juniper.net/JSA69999 for more information.

Vendor Statement

Juniper Networks has published Juniper Security Advisory JSA69999 regarding the recent pair of HIGH severity OpenSSL vulnerabilities announced by the OpenSSL project team.

References

https://kb.juniper.net/JSA69999

lighttpd Affected

Notified: 2022-10-31 Updated: 2022-11-09

Statement Date: November 07, 2022

CVE-2022-3602

Affected

CVE-2022-3786

Affected

Vendor Statement

We have not received a statement from the vendor.

Microsoft Affected

Notified: 2022-10-31 Updated: 2022-11-11

Statement Date: November 10, 2022

CVE-2022-3602

Affected

Vendor Statement:

Microsoft is aware of and is actively addressing impacts associated with the recent OpenSSL vulnerabilities announced on October 25, 2022. Microsoft has added these CVEs to the Security Update Guide to document any impact of these vulnerabilities on our products or services.

References:

https://msrc-blog.microsoft.com/2022/11/02/microsoft-guidance-related-to-openssl-risk-cve-2022-3786-and-cve-2202-3602/

CVE-2022-3786

Affected

Vendor Statement:

References:

https://msrc-blog.microsoft.com/2022/11/02/microsoft-guidance-related-to-openssl-risk-cve-2022-3786-and-cve-2202-3602/

OpenSSL Affected

Notified: 2022-10-31 Updated: 2022-11-01

Statement Date: November 01, 2022

CVE-2022-3602

Affected

Vendor Statement:

https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/

CVE-2022-3786

Affected

Vendor Statement:

https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/

References

https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/

Red Hat Affected

Notified: 2022-10-28 Updated: 2022-11-01

Statement Date: November 01, 2022

CVE-2022-3602

Affected

CVE-2022-3786

Affected

Vendor Statement

Only Red Hat Enterprise Linux version 9 is affected by this vulnerability. Red Hat Enterprise Linux 8 and below are not affected, because are based on OpenSSL version 1, which is not affected by this issue.

References

https://access.redhat.com/security/vulnerabilities/RHSB-2022-004

SolarWinds Affected

Notified: 2022-10-31 Updated: 2022-11-09

Statement Date: November 07, 2022

CVE-2022-3602

Affected

Vendor Statement:

Statement: After reviewing our software, SolarWinds has found that we are vulnerable in the following product. • SolarWinds Serv-U Version 15.3.1 We have not had any reports of this vulnerability being exploited in the wild. We have confirmed all other SolarWinds products ARE NOT KNOWN TO BE AFFECTED by this issue, including the Orion Platform and all its modules.

CVE-2022-3786

Affected

Vendor Statement:

After reviewing our software, SolarWinds has found the following product(s) are vulnerable to this issue: • SolarWinds Serv-U Version 15.3.1 We have not had any reports of this vulnerability being exploited in the wild. We have confirmed all other SolarWinds products ARE NOT KNOWN TO BE AFFECTED by this issue, including the Orion Platform and all its modules.

Squid Affected

Notified: 2022-10-31 Updated: 2022-12-14

Statement Date: December 10, 2022

CVE-2022-3602

Affected

CVE-2022-3786

Affected

These OpenSSL issues affected Ubuntu 22.04 LTS and Ubuntu 22.10; older Ubuntu releases are not affected. Updates that address the issues have been published.

References

https://ubuntu.com/security/notices/USN-5710-1

Unify Software and Solutions GmbH and Co. KG Affected

Notified: 2022-10-31 Updated: 2022-11-09

Statement Date: November 07, 2022

CVE-2022-3602

Affected

Vendor Statement:

We have issued a vulnerability impact statement on the Atos Unify Support portal (registers users only). Early next week we will issue a security advisory on our website.

References:

Knowledge Base Article on Atos Unify Support Portal (published)
https://atosunify.service-now.com/kb_view.do?sysparm_article=KB000105083
Security Advisory (not published yet)
https://unify.com/en/support/security-advisories

CVE-2022-3786

Affected

Vendor Statement:

We have issued a vulnerability impact statement on the Atos Unify Support portal (registers users only). Early next week we will issue a security advisory on our website.

References:

Knowledge Base Article on Atos Unify Support Portal (published)
https://atosunify.service-now.com/kb_view.do?sysparm_article=KB000105083
Security Advisory (not published yet)
https://unify.com/en/support/security-advisories

Vendor Statement

We have issued a vulnerability impact statement on the Atos Unify Support portal (registers users only). https://atosunify.service-now.com/kb_view.do?sysparm_article=KB000105083 A security advisory will be published on our website. https://unify.com/en/support/security-advisories

Valmet Affected

Notified: 2022-10-31 Updated: 2022-11-01

Statement Date: November 01, 2022

CVE-2022-3602

Affected

CVE-2022-3786

Unknown

Vendor Statement

We have not received a statement from the vendor.

VanDyke Software Affected

Notified: 2022-10-31 Updated: 2022-11-16

Statement Date: November 14, 2022

CVE-2022-3602

Affected

CVE-2022-3786

Affected

Vendor Statement

See https://www.vandyke.com/support/advisory/2022/11/open-ssl-300-through-306-vulnerabilities.html.

Products Not Affected

All VanDyke Software products on supported Windows platforms.
All VanDyke Software products on supported RHEL platforms.
All VanDyke Software products on supported macOS platforms.
All VanDyke Software products on supported Ubuntu platforms version 20.04 and earlier.
SecureCRT/SecureFX version 9.3 on Ubuntu 22.04 platforms which have already been patched with OpenSSL version 3.0.7 or newer.
VShell version 4.8 on Ubuntu 22.04 platforms which have already been patched with OpenSSL version 3.0.7 or newer.

Products Affected

SecureCRT/SecureFX version 9.3, only on Ubuntu 22.04 platforms which have not yet been patched with OpenSSL version 3.0.7 or newer.
VShell version 4.8, only on Ubuntu 22.04 platforms which have not yet been patched with OpenSSL version 3.0.7 or newer.

Resolution for Ubuntu 22.04

Patch Ubuntu 22.04 with OpenSSL version 3.0.7 or newer.

References

Wind River Affected

Notified: 2022-10-31 Updated: 2022-11-01

Statement Date: November 01, 2022

CVE-2022-3602

Affected

CVE-2022-3786

Affected

Vendor Statement

https://support2.windriver.com/index.php?page=security-notices&on=view&id=7916

References

https://support2.windriver.com/index.php?page=security-notices&on=view&id=7916

Vendor Statement:

Vendor Statement

Android Open Source Project Not Affected

Notified: 2022-10-31 Updated: 2022-11-01

Statement Date: October 31, 2022

CVE-2022-3602

Not Affected

CVE-2022-3786

Unknown

Vendor Statement

We have not received a statement from the vendor.

Apache Solr Not Affected

Notified: 2022-10-31 Updated: 2022-11-01

Statement Date: November 01, 2022

CVE-2022-3602

Not Affected

CVE-2022-3786

Not Affected

Vendor Statement:

Solr's SSL support is provided by Java, which isn't OpenSSL based. There is a Docker image for Solr 9 & Solr 8, and thus are layered above operating system base layers. For both, OpenSSL 1.1.1 is included, which is not vulnerable. However some users may need to re-pull published images, as some recent releases did include vulnerable openssl. Still; it's unused.

References:

docker run --rm solr:9 openssl version
docker run --rm solr:8 openssl version

Vendor Statement

Solr's SSL support is provided by Java, which isn't OpenSSL based.

Not Affected

Vendor Statement:

**November 14, 2022** **CVE**: CVE-2022-3602 **Bug**: N/A **Synopsis**: On November 1, 2022, a vulnerability was detected in OpenSSL, an open-source robust, commercial-grade, full-featured toolkit for general-purpose cryptography and secure communication. **Description**: An attacker can craft a malicious email address to overflow an arbitrary number of bytes containing the `.` character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). **Resolution**: Artifex products, as shipped, are not vulnerable. **Impacted Products**: Ghostscript: Does not use OpenSSL; not affected. MuPDF: Does use OpenSSl as installed on the host OS. Users should ensure the installed version of OpenSSL is not vulnerable. SmartOffice: Uses an earlier version of OpenSSL which is unaffected. MuJS: Does not use OpenSSL; not affected. jbig2dec: Does not use OpenSSL; not affected. ScanSkew: Does not use OpenSSL; not affected. ASPEN: Does not use OpenSSL; not affected.

Aruba Networks Not Affected

Notified: 2022-10-31 Updated: 2022-11-01

Statement Date: October 31, 2022

CVE-2022-3602

Not Affected

CVE-2022-3786

Unknown

Vendor Statement

We have not received a statement from the vendor.

Atos SE Not Affected

Notified: 2022-10-31 Updated: 2022-11-09

Statement Date: November 07, 2022

Notified: 2022-10-31 Updated: 2022-11-09

Statement Date: November 07, 2022

CVE-2022-3602

Not Affected

Vendor Statement:

Check Point Products are not affected except some agent deployments in CloudGuard AppSec. For CloudGuard AppSec, some agent deployments use a vulnerable OpenSSL library as SSL clients (whereas the vulnerability mainly impacts server side usage of SSL). Regardless, an updated version of those agents is published. Customers with agent upgrade mode set to "Automatic", receive the fixed version automatically. For additional information, refer to the article in the reference.

References:

https://appsec-doc.inext.checkpoint.com/references/cve-2022-3786-and-cve-2022-3602-openssl-x.509-email-address-buffer-overflows-high

CVE-2022-3786

Not Affected

Vendor Statement:

References:

https://appsec-doc.inext.checkpoint.com/references/cve-2022-3786-and-cve-2022-3602-openssl-x.509-email-address-buffer-overflows-high

References:

https://support.f5.com/csp/article/K44030142

CVE-2022-3786

Not Affected

Vendor Statement:

No F5 products use vulnerable versions of OpenSSL.

References:

https://support.f5.com/csp/article/K44030142

Vendor Statement

No F5 products use vulnerable versions of OpenSSL

References

https://support.f5.com/csp/article/K44030142

Vendor Statement

Keysight has assessed our product portfolio and has determined that none of our products are exploitable by these CVEs.

References

https://www.keysight.com/us/en/about/quality-and-security/security/product-and-solution-cyber-security/security-advisory-archive/security-advisory-cve-2022-3786-cve-2022-3602.html

Lacework Not Affected

Notified: 2022-10-31 Updated: 2022-12-09

Statement Date: December 08, 2022

CVE-2022-3602

Not Affected

CVE-2022-3786

Not Affected

Vendor Statement

We have not received a statement from the vendor.

LibreOffice Not Affected

Notified: 2022-10-31 Updated: 2022-12-09

Statement Date: December 07, 2022

CVE-2022-3602

Not Affected

Vendor Statement:

LibreOffice 7.5 series is using OpenSSL3, but >= 3.0.7 which is unaffected

CVE-2022-3786

Not Affected

Vendor Statement:

Not Affected

Vendor Statement:

OpenSSL 1.1.1 (LTS) is used exclusively for all Macrium public releases. Therefore, there is no exposure to CVE-2022-3786.

Vendor Statement

OpenSSL 1.1.1 (LTS) is used exclusively for all Macrium public releases. Therefore, there is no exposure to either CVE-2022-3602 or CVE-2022-3786.

Menlo Security Not Affected

Notified: 2022-10-31 Updated: 2022-11-01

Statement Date: November 01, 2022

CVE-2022-3602

Not Affected

Vendor Statement:

We have confirmed that Menlo Security products are not affected by this vulnerability.

CVE-2022-3786

Not Affected

Vendor Statement:

Not Affected

Vendor Statement:

Navis does not the use of the affected versions of OpenSSL in our environment.

References:

CVE-2022-3786

Not Affected

Vendor Statement:

Navis does not uses the affected versions of OpenSSL in our environment.

Vendor Statement

Navis does not uses the affected versions of OpenSSL in our environment

We have not received a statement from the vendor.

References

https://kb.paessler.com/en/topic/91170-is-paessler-prtg-affected-by-cve-2022-3786-and-cve-2022-3602

Palisade Systems Not Affected

Notified: 2022-10-31 Updated: 2022-11-09

Statement Date: November 07, 2022

CVE-2022-3602

Not Affected

CVE-2022-3786

Not Affected

Vendor Statement

We have not received a statement from the vendor.

Palo Alto Networks Not Affected

Notified: 2022-10-31 Updated: 2022-11-01

Statement Date: November 01, 2022

CVE-2022-3602

Not Affected

CVE-2022-3786

Not Affected

Vendor Statement

Palo Alto Networks has published https://security.paloaltonetworks.com/PAN-SA-2022-0006 to provide the latest status on these issues as they relate to our products.

References

https://security.paloaltonetworks.com/PAN-SA-2022-0006

Peplink Not Affected

Notified: 2022-10-31 Updated: 2022-12-09

Statement Date: December 01, 2022

CVE-2022-3602

Not Affected

CVE-2022-3786

Not Affected

Vendor Statement

We have not received a statement from the vendor.

pfSense Not Affected

Notified: 2022-10-31 Updated: 2022-11-01

Statement Date: November 01, 2022

CVE-2022-3602

Not Affected

Vendor Statement:

Current releases of pfSense software (Plus and CE) use OpenSSL version 1.1.1 and are not affected.

References:

https://github.com/pfsense/FreeBSD-src/tree/devel-12/crypto/openssl

CVE-2022-3786

Not Affected

Vendor Statement:

Current releases of pfSense software (Plus and CE) use OpenSSL version 1.1.1 and are not affected.

References:

https://github.com/pfsense/FreeBSD-src/tree/devel-12/crypto/openssl

Vendor Statement

Current releases of pfSense software (Plus and CE) use OpenSSL version 1.1.1 and are not affected.

References

https://github.com/pfsense/FreeBSD-src/tree/devel-12/crypto/openssl

Pi-Hole Not Affected

Notified: 2022-10-31 Updated: 2022-11-01

Statement Date: October 31, 2022

CVE-2022-3602

Not Affected

CVE-2022-3786

Unknown

Vendor Statement

We have not received a statement from the vendor.

plixer Not Affected

Notified: 2022-10-31 Updated: 2022-11-16

Statement Date: November 15, 2022

CVE-2022-3602

Not Affected

References

https://freshservice.onqpr.com/support/announcements/50000019531

Vendor Statement

We do not use the affected versions.

Roche Diagnostics International AG Not Affected

Notified: 2022-10-31 Updated: 2022-11-09

Statement Date: November 05, 2022

CVE-2022-3602

Not Affected

Vendor Statement:

The OpenSSL library in the affected versions is not leveraged in Roche Products.

CVE-2022-3786

Not Affected

Vendor Statement:

We have not received a statement from the vendor.

References

https://www.sophos.com/en-us/security-advisories/sophos-sa-20221031-openssl-vuln

Tychon Not Affected

Notified: 2022-10-31 Updated: 2023-03-06

Statement Date: February 24, 2023

CVE-2022-3602

Not Affected

Vendor Statement:

Tychon product suites are not affected by this vulnerability as we are operating on the ELS OpenSSL 1.0.2.

References:

https://www.openssl.org/news/secadv/20221101.txt

CVE-2022-3786

Not Affected

Vendor Statement:

Tychon product suites are not affected by this vulnerability as we are operating on the ELS OpenSSL 1.0.2.

References:

https://www.openssl.org/news/secadv/20221101.txt

Ubiquiti Not Affected

Notified: 2022-10-31 Updated: 2022-11-01

Statement Date: November 01, 2022

CVE-2022-3602

Not Affected

CVE-2022-3786

Unknown

Vendor Statement

We have not received a statement from the vendor.

References

https://community.ui.com/releases/Statement-Regarding-OpenSSL-3-x-Vulnerability-001/86d4308a-a65d-4a26-90c8-0ac068dd757e

References

https://trust.zscaler.com/zscaler.net/posts/12411

References

https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-2115

Fuji_Electric_Hakko_Electric Unknown

Notified: 2022-10-31 Updated: 2022-11-01

Notified: 2022-10-31 Updated: 2022-11-01

Notified: 2022-10-31 Updated: 2022-11-01

Notified: 2022-10-31 Updated: 2022-11-01

Notified: 2022-10-31 Updated: 2022-11-01

Notified: 2022-10-31 Updated: 2022-11-01

Software Engineering Institute

CERT Coordination Center

OpenSSL 3.0.0 to 3.0.6 decodes some punycode email addresses in X.509 certificates improperly

Vulnerability Note VU#794340

Overview

Description

Impact

Solution

Acknowledgements

Vendor Information

Adobe Affected

Barracuda Networks Affected

Vendor Statement

References

Citrix Affected

Vendor Statement

References

Crestron Electronics Affected

Vendor Statement

Digi International Affected

FreeRADIUS Affected

Vendor Statement

Fujitsu Affected

Vendor Statement

HardenedBSD Affected

Vendor Statement

Iconics Inc. Affected

Vendor Statement

Illumos Affected

Vendor Statement

Joyent Affected

Vendor Statement

Juniper Networks Affected

Vendor Statement

References

lighttpd Affected

Vendor Statement

Microsoft Affected

OpenSSL Affected

References

Red Hat Affected

Vendor Statement

References

SolarWinds Affected

Squid Affected

Vendor Statement

SUSE Linux Affected

Vendor Statement

Triton Data Center Affected

Vendor Statement

Ubuntu Affected

Vendor Statement

References

Unify Software and Solutions GmbH and Co. KG Affected

Vendor Statement

Valmet Affected

Vendor Statement

VanDyke Software Affected

Vendor Statement

Products Not Affected

Products Affected

Resolution for Ubuntu 22.04

References

Wind River Affected

Vendor Statement

References

ACROS Security Not Affected

Vendor Statement

Advantech Czech Not Affected

Vendor Statement

AirDroid Not Affected

Vendor Statement

Allegro Software Development Corporation Not Affected

Vendor Statement

Android Open Source Project Not Affected

Vendor Statement

Apache Solr Not Affected

Vendor Statement

Applied Informatics GmbH Not Affected

Vendor Statement