Lucene search
OpensslCVELIST:CVE-2022-3996HistoryDec 13, 2022 - 3:43 p.m.
CVE-2022-3996 X.509 Policy Constraints Double Locking
2022-12-1315:43:06
CWE-667
openssl
www.cve.org
12
x.509
policy constraints
double locking
certificate
vulnerability
denial of service
windows
publicly facing server
If an X.509 certificate contains a malformed policy constraint and
policy processing is enabled, then a write lock will be taken twice
recursively. On some operating systems (most widely: Windows) this
results in a denial of service when the affected process hangs. Policy
processing being enabled on a publicly facing server is not considered
to be a common setup.
Policy processing is enabled by passing the -policy' argument to the command line utilities or by calling the X509_VERIFY_PARAM_set1_policies()’ function.
Update (31 March 2023): The description of the policy processing enablement
was corrected based on CVE-2023-0466.
CNA Affected
[
{
"defaultStatus": "unaffected",
"product": "OpenSSL",
"vendor": "OpenSSL",
"versions": [
{
"lessThanOrEqual": "3.0.7",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
]Related
debiancve
debiancve
CVE-2022-3996
2022-12-13 16:15:22
CVE-2023-0466
2023-03-28 15:15:06
prion
prion
Design/Logic Flaw
2022-12-13 16:15:00
Design/Logic Flaw
2023-03-28 15:15:00
cve
cve
CVE-2022-3996
2022-12-13 16:15:22
CVE-2023-0466
2023-03-28 15:15:06
ubuntucve
ubuntucve
CVE-2022-3996
2022-12-13 00:00:00
CVE-2023-0466
2023-03-28 00:00:00
openssl
openssl
Vulnerability in OpenSSL - X.509 Policy Constraints Double Locking
2022-12-13 00:00:00
Vulnerability in OpenSSL - Certificate policy check not enabled
2023-03-21 00:00:00
nvd
nvd
CVE-2022-3996
2022-12-13 16:15:22
CVE-2023-0466
2023-03-28 15:15:06
osv
osv
CVE-2022-3996
2022-12-13 16:15:22
openssl, openssl1.0 vulnerabilities
2023-04-25 15:53:53
libopenssl-3-devel-3.0.7-2.1 on GA media
2024-06-15 00:00:00
vulnrichment
vulnrichment
CVE-2022-3996 X.509 Policy Constraints Double Locking
2022-12-13 15:43:06
alpinelinux
alpinelinux
CVE-2022-3996
2022-12-13 16:15:22
CVE-2023-0466
2023-03-28 15:15:06
nessus
nessus
SUSE SLED15 / SLES15 Security Update : openssl-3 (SUSE-SU-2022:4586-1)
2022-12-21 00:00:00
Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.04 : OpenSSL vulnerabilities (USN-6039-1)
2023-04-25 00:00:00
Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2023-095)
2023-03-21 00:00:00
cloudlinux
cloudlinux
openssl: Fix of 3 CVEs
2023-05-04 21:42:17
ubuntu
ubuntu
OpenSSL vulnerabilities
2023-04-25 00:00:00
openvas
openvas
Ubuntu: Security Advisory (USN-6039-1)
2023-04-26 00:00:00
cloudfoundry
cloudfoundry
USN-6039-1: OpenSSL vulnerabilities | Cloud Foundry
2023-06-30 00:00:00
veracode
veracode
Improper Locking
2023-01-06 08:19:51
Authorization Bypass
2023-04-02 10:15:03
cgr
cgr
CVE-2022-3996 vulnerabilities
2024-05-19 03:07:16
wolfi
wolfi
CVE-2022-3996 vulnerabilities
2024-09-30 09:32:54
nodejsblog
nodejsblog
OpenSSL 3.0.7 update assessment
2022-12-16 00:00:00
redhatcve
redhatcve
CVE-2022-3996
2022-12-14 11:04:49
CVE-2023-0466
2023-03-30 09:13:38
photon
photon
Important Photon OS Security Update - PHSA-2023-0308
2023-01-05 00:00:00
Important Photon OS Security Update - PHSA-2023-4.0-0308
2023-01-05 00:00:00
Critical Photon OS Security Update - PHSA-2023-4.0-0415
2023-06-22 00:00:00
cbl_mariner
cbl_mariner
CVE-2022-3996 affecting package edk2 for versions less than 20240223gitedc6681206c1-2
2024-08-14 20:42:16
CVE-2023-0466 affecting package openssl 1.1.1k-13
2023-04-20 19:17:28
CVE-2023-0466 affecting package openssl for versions less than 1.1.1k-23
2023-05-03 16:09:09
github
github
openssl-src subject to DoS by double-checked locking
2022-12-13 18:30:33
cvelist
cvelist
CVE-2023-0466 Certificate policy check not enabled
2023-03-28 14:30:49
ibm
ibm
f5
f5
K000134574 : OpenSSL vulnerabilities CVE-2023-0465 and CVE-2023-0466
2023-05-11 00:00:00
freebsd
freebsd
OpenSSL -- Multiple vulnerabilities
2023-03-28 00:00:00
Python -- multiple vulnerabilities
2022-06-08 00:00:00
amazon
amazon
Medium: openssl11
2023-05-11 17:49:00
Medium: openssl
2023-06-05 16:39:00
Medium: openssl
2023-06-05 16:39:00
debian
debian
[SECURITY] [DLA 3449-1] openssl security update
2023-06-08 16:32:36
[SECURITY] [DSA 5417-1] openssl security update
2023-05-31 14:50:37
almalinux
almalinux
Moderate: openssl security and bug fix update
2023-06-21 00:00:00
fedora
fedora
[SECURITY] Fedora 38 Update: openssl-3.0.9-1.fc38
2023-06-03 02:46:16
[SECURITY] Fedora 37 Update: openssl-3.0.9-1.fc37
2023-06-04 01:24:09
oraclelinux
oraclelinux
openssl security and bug fix update
2023-06-22 00:00:00
openssl security update
2023-08-31 00:00:00
redhat
redhat
rosalinux
rosalinux
Advisory ROSA-SA-2024-2366
2024-03-05 08:46:27
aix
aix
Multiple vulnerabilities in OpenSSL affect AIX
2023-09-11 10:43:54
Multiple vulnerabilities in OpenSSL affect AIX
2023-03-21 13:26:15
thn
thn
OpenSSL Fixes Multiple New Security Flaws with Latest Update
2023-02-09 09:51:00
ics
ics
Siemens SCALANCE XM-400, XR-500
2024-06-13 12:00:00
mageia
mageia
Updated openssl packages fix security vulnerability
2023-04-11 22:02:20