X.509 Email Address Variable Length Buffer Overflow
Priority HIGH 82CWE-120Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-120 and the CVSS impact.
Summary
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.92488 99th percentileScored 2026-11-07
Fix Partial OpenSSL (OpenSSL): 3.0.7openssl-src (crates.io): 300.0.11Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenSSL | OpenSSL | 3.0.0 to before 3.0.7 | 3.0.7 | Patch available | CNA |
| — | openssl-src (crates.io) | 300.0.0 to before 300.0.11 | 300.0.11 | Patch available | GHSA-h8jm-2x53-xhp5 |
- OpenSSL VendorOpenSSL Affected 3.0.0 to before 3.0.7 Fixed in 3.0.7 Patch available CNA
- openssl-src (crates.io) Vendor— Affected 300.0.0 to before 300.0.11 Fixed in 300.0.11 Patch available GHSA-h8jm-2x53-xhp5
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* | 3.0.0 to before 3.0.7 | Vulnerable | OpenSSL |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | 18.0.0 to before 18.11.0 | Vulnerable | NodeJS |
| cpe:2.3:a:nodejs:node.js:18.12.0:*:*:*:lts:*:*:* | 18.12.0 | Vulnerable | NodeJS |
| cpe:2.3:a:nodejs:node.js:19.0.0:*:*:*:-:*:*:* | 19.0.0 | Vulnerable | NodeJS |
- cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.0.7 Vulnerable ·OpenSSL
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 18.0.0 to before 18.11.0 Vulnerable ·NodeJS
- cpe:2.3:a:nodejs:node.js:18.12.0:*:*:*:lts:*:*:* Versions 18.12.0 Vulnerable ·NodeJS
- cpe:2.3:a:nodejs:node.js:19.0.0:*:*:*:-:*:*:* Versions 19.0.0 Vulnerable ·NodeJS
Remediation
- Fix · CNA OpenSSL (OpenSSL) Fixed in 3.0.7
- Fix · GHSA-h8jm-2x53-xhp5 openssl-src (crates.io) Fixed in 300.0.11 Advisory →
Red Hat 2 advisories
- RHSA-2022:7384 Released 2022-11-02 · Red Hat rating Importantopenssl-container security update
- Red Hat Enterprise Linux AppStream (v. 9) rhel9/openssl, ubi9/openssl
- RHSA-2022:7288 Released 2022-11-01 · Red Hat rating Importantopenssl security update
- Red Hat Enterprise Linux AppStream (v. 9) openssl-devel-1:3.0.1-43.el9_0, openssl-perl-1:3.0.1-43.el9_0
- Red Hat Enterprise Linux BaseOS (v. 9) openssl-1:3.0.1-43.el9_0, openssl-libs-1:3.0.1-43.el9_0
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Logging Subsystem for Red Hat OpenShift | Affected | — |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2022:7288, RHSA-2022:7384 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2022:7288 |
Not affected: 10 products
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Core Services
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Web Server 3
- Red Hat JBoss Web Server 5
- Red Hat Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2022-3786
- 2026-10-03 Alias added: GHSA-h8jm-2x53-xhp5
References
Patch 1
Other 46
- https://github.com/rustsec/advisory-db/pull/1452
- https://github.com/alexcrichton/openssl-src-rs/commit/4a31c14f31e1a08c18893a37e304dd1dd4b7daa3
- https://github.com/openssl/openssl/commit/fe3b639dc19b325846f4f6801f2f4604f56e3de3
- https://www.kb.cert.org/vuls/id/794340
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-W9sdCc2a
- https://security.netapp.com/advisory/ntap-20221102-0001
- https://security.gentoo.org/glsa/202211-01
- https://rustsec.org/advisories/RUSTSEC-2022-0065.html
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0023
- https://lists.fedoraproject.org/archives/list/[email protected]/message/DWP23EZYOBDJQP7HP4YU7W2ABU2YDITS
- https://lists.fedoraproject.org/archives/list/[email protected]/message/63YRPWPUSX3MBHNPIEJZDKQT6YA7UF6S
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DWP23EZYOBDJQP7HP4YU7W2ABU2YDITS
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63YRPWPUSX3MBHNPIEJZDKQT6YA7UF6S
- https://github.com/alexcrichton/openssl-src-rs
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=c42165b5706e42f67ef8ef4c351a9a4c5d21639a
- http://packetstormsecurity.com/files/169687/OpenSSL-Security-Advisory-20221101.html
- http://www.openwall.com/lists/oss-security/2022/11/01/15
- http://www.openwall.com/lists/oss-security/2022/11/01/16
- http://www.openwall.com/lists/oss-security/2022/11/01/17
- http://www.openwall.com/lists/oss-security/2022/11/01/18
- http://www.openwall.com/lists/oss-security/2022/11/01/19
- http://www.openwall.com/lists/oss-security/2022/11/01/20
- http://www.openwall.com/lists/oss-security/2022/11/01/21
- http://www.openwall.com/lists/oss-security/2022/11/01/24
- http://www.openwall.com/lists/oss-security/2022/11/02/1
- http://www.openwall.com/lists/oss-security/2022/11/02/10
- http://www.openwall.com/lists/oss-security/2022/11/02/11
- http://www.openwall.com/lists/oss-security/2022/11/02/12
- http://www.openwall.com/lists/oss-security/2022/11/02/13
- http://www.openwall.com/lists/oss-security/2022/11/02/14
- http://www.openwall.com/lists/oss-security/2022/11/02/15
- http://www.openwall.com/lists/oss-security/2022/11/02/2
- http://www.openwall.com/lists/oss-security/2022/11/02/3
- http://www.openwall.com/lists/oss-security/2022/11/02/5
- http://www.openwall.com/lists/oss-security/2022/11/02/6
- http://www.openwall.com/lists/oss-security/2022/11/02/7
- http://www.openwall.com/lists/oss-security/2022/11/02/9
- http://www.openwall.com/lists/oss-security/2022/11/03/1
- http://www.openwall.com/lists/oss-security/2022/11/03/10
- http://www.openwall.com/lists/oss-security/2022/11/03/11
- http://www.openwall.com/lists/oss-security/2022/11/03/2
- http://www.openwall.com/lists/oss-security/2022/11/03/3
- http://www.openwall.com/lists/oss-security/2022/11/03/5
- http://www.openwall.com/lists/oss-security/2022/11/03/6
- http://www.openwall.com/lists/oss-security/2022/11/03/7
- http://www.openwall.com/lists/oss-security/2022/11/03/9
More Openssl vulnerabilities
- TI-2022-01915 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
- TI-2021-02645 SM2 Decryption Buffer Overflow CVSS 3.1CRITICAL 9.8
- TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
- TI-2022-01176 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
- TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
- TI-2025-14107 Stack buffer overflow in CMS (Auth)EnvelopedData parsing CVSS 3.1HIGH 8.8
Sources
- CVE-2022-3786 · CVE Program
- CVE-2022-3786 · NVD
- FIRST EPSS
- GHSA-h8jm-2x53-xhp5 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-3786 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences