TI-2022-03665 Aliases CVE-2022-3996 GHSA-vr8j-hgmm-jh9r

X.509 Policy Constraints Double Locking

MEDIUM 41CWE-667Published 2022-12-13 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-667 and the CVSS impact.

Summary

If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy processing being enabled on a publicly facing server is not considered to be a common setup. Policy processing is enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. Update (31 March 2023): The description of the policy processing enablement was corrected based on CVE-2023-0466.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01312 70th percentileScored 2026-11-07

Fix Fixed openssl-src (crates.io): 300.0.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenSSL	OpenSSL	3.0.0 – 3.0.7	—	No fix listed	CNA
—	openssl-src (crates.io)	300.0.0 to before 300.0.12	300.0.12	Patch available	GHSA-vr8j-hgmm-jh9r

OpenSSL VendorOpenSSL Affected 3.0.0 – 3.0.7 Fixed in — No fix listed CNA
openssl-src (crates.io) Vendor— Affected 300.0.0 to before 300.0.12 Fixed in 300.0.12 Patch available GHSA-vr8j-hgmm-jh9r

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:openssl:openssl::::::::	3.0.0 – 3.0.7	Vulnerable	OpenSSL

cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* Versions 3.0.0 – 3.0.7 Vulnerable ·OpenSSL

Remediation

Fix · GHSA-vr8j-hgmm-jh9r openssl-src (crates.io) Fixed in 300.0.12 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Not affected: 7 products

Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat JBoss Core Services
Red Hat JBoss Web Server 3
Red Hat JBoss Web Server 5

Timeline

2026-10-02 Threatist record created from CVE-2022-3996
2026-10-03 Alias added: GHSA-vr8j-hgmm-jh9r

References

Patch 1

https://github.com/openssl/openssl/commit/7725e7bfe6f2ce8146b6552b44e0d226be7638e7

Advisory 2

Other 1

https://github.com/alexcrichton/openssl-src-rs

TI-2022-01915 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
TI-2021-02645 SM2 Decryption Buffer Overflow CVSS 3.1CRITICAL 9.8
TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
TI-2022-01176 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
TI-2025-14107 Stack buffer overflow in CMS (Auth)EnvelopedData parsing CVSS 3.1HIGH 8.8

See all 312 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences