CVE-2022-3996

2022-12-1316:15:22

Debian Security Bug Tracker

security-tracker.debian.org

x.509 certificate

denial of service

windows

policy processing

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.6

Confidence

High

EPSS

0.002

Percentile

55.1%

JSON

If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy processing being enabled on a publicly facing server is not considered to be a common setup. Policy processing is enabled by passing the -policy' argument to the command line utilities or by calling the X509_VERIFY_PARAM_set1_policies()’ function. Update (31 March 2023): The description of the policy processing enablement was corrected based on CVE-2023-0466.

OSVersionArchitecturePackageVersionFilename
Debian12allopenssl< 3.0.7-2openssl_3.0.7-2_all.deb
Debian11allopenssl< 1.1.1w-0+deb11u1openssl_1.1.1w-0+deb11u1_all.deb
Debian999allopenssl< 3.0.7-2openssl_3.0.7-2_all.deb
Debian13allopenssl< 3.0.7-2openssl_3.0.7-2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	openssl	< 3.0.7-2	openssl_3.0.7-2_all.deb
Debian	11	all	openssl	< 1.1.1w-0+deb11u1	openssl_1.1.1w-0+deb11u1_all.deb
Debian	999	all	openssl	< 3.0.7-2	openssl_3.0.7-2_all.deb
Debian	13	all	openssl	< 3.0.7-2	openssl_3.0.7-2_all.deb