CVE-2022-3602 and CVE-2022-3786 – OpenSSL 3.0.X Critical Vulnerabilities

Share :

On 25 October 2022, the OpenSSL project announced the existence of a critical vulnerability in the OpenSSL library affecting OpenSSL versions 3.0.0 and above, as well as any application with an embedded, impacted OpenSSL library. This announcement did not include any details on what this vulnerability is or how it can be exploited. 

On 1 November 2022, a cryptographic library used for encrypting communications in a wide variety of applications on the internet. Arctic Wolf Labs is providing an update with remediation guidance based on new information that has been disclosed about the OpenSSL vulnerabilities (CVE-2022-3602 and CVE-2022-3786). 

OpenSSL had originally announced the existence of a security vulnerability that was originally described as critical. However, in the 3.0.7 release on November 1st, 2022, OpenSSL has downgraded the severity to high severity after further consultation with the community.  

Arctic Wolf Labs has investigated this vulnerability and has determined that remote code exploitation may only be viable under very specific circumstances. 

OpenSSL has clarified that this vulnerability can only be exploited in instances where a certificate authority has signed a maliciously-crafted certificate. They have also stated that stack overflow prevention technologies found in modern platforms greatly reduce the probability of this type of exploit succeeding. 

At this point, neither Arctic Wolf nor the OpenSSL project have seen active exploitation of remote code execution with these vulnerabilities. As the industry responds to the disclosed OpenSSL vulnerabilities, vendors will release patches for their affected applications.

In practice, however, because successful exploitation has not yet been demonstrated in the wild, these patches should be planned as part of the regular patch cycle rather than being prioritised ahead of other critical patches out-of-band. 

Recommendation: Patch any affected applications within your normal patching cycle 

Software vendors will provide specific guidance for their affected products. At this time, due to the theoretical constraints limiting exploitation, we do not recommend prioritising patching of these vulnerabilities out-of-band of your patching cycle due to a low likelihood of successful remote code execution exploitation. 

For a limited list of potentially affected applications, see the following resource: OpenSSL-2022/software at main · NCSC-NL/OpenSSL-2022 

Note: This is a community-sourced resource maintained by the National Cyber Security Centrum in the Netherlands. 


Picture of Adrian Korn

Adrian Korn

Adrian Korn is a seasoned cyber security professional with 7+ years' experience in cyber threat intelligence, threat detection, and security operations. He currently serves as the Manager of Threat Intelligence Research at Arctic Wolf Labs. Adrian has been a guest speaker on intelligence related topics at numerous conferences around the world, including DEF CON's Recon Village, Hackfest, and the Australian OSINT Symposium.
Share :
Table of Contents