OpenSSL Releases Patch for 2 New High
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2014-0160 | Heartbleed: unauthenticated memory disclosure in OpenSSL TLS/DTLS heartbeat handling | — | 100% | KEV | — KEV |
| CVE-2016-6309 | statem/statem.c in OpenSSL 1.1.0a does not consider memory-block movement after a realloc call, which allows remote attackers to cause a denial of service… | 9.8 | 70% | ||
CVE-2022-3786+1 related CVE | A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking | 7.5 | 92% |
From the original article
4 min read at thehackernews.com
The OpenSSL project has rolled out fixes to contain two high-severity flaws in its widely used cryptography library that could result in a denial-of-service (DoS) and remote code execution. The issues, tracked as CVE-2022-3602 and CVE-2022-3786 , have been described as buffer overrun vulnerabilities that can be triggered during X. 509 certificate verification by supplying a specially-crafted email address.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.