Read the docs
TI-2022-04067 Aliases CVE-2022-4450GHSA-v5w6-wcm8-jm4q

Double free after calling PEM_read_bio_ex

Priority MEDIUM 62CWE-415Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 15 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-415 and the CVSS impact.

Summary

The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.2859 98th percentileScored 2026-11-07
Fix Partial OpenSSL (OpenSSL): 3.0.8, 1.1.1topenssl-src (crates.io): 111.25.0, 300.0.12Red Hat: 10 advisoriesRed Hat: 15 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenSSLOpenSSL3.0.0 to before 3.0.8; 1.1.1 to before 1.1.1t3.0.8, 1.1.1tPatch availableCNA
—openssl-src (crates.io)before 111.25.0111.25.0Patch availableGHSA-v5w6-wcm8-jm4q
—openssl-src (crates.io)300.0.0 to before 300.0.12300.0.12Patch availableGHSA-v5w6-wcm8-jm4q
  • OpenSSL VendorOpenSSL Affected 3.0.0 to before 3.0.8; 1.1.1 to before 1.1.1t Fixed in 3.0.8, 1.1.1t Patch available CNA
  • openssl-src (crates.io) Vendor— Affected before 111.25.0 Fixed in 111.25.0 Patch available GHSA-v5w6-wcm8-jm4q
  • openssl-src (crates.io) Vendor— Affected 300.0.0 to before 300.0.12 Fixed in 300.0.12 Patch available GHSA-v5w6-wcm8-jm4q

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*1.1.1 to before 1.1.1t; 3.0.0 to before 3.0.8VulnerableOpenSSL
cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*4.0.0 to before 4.3.16; 4.4.0 to before 4.6.3VulnerableStormshield
  • cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* Versions 1.1.1 to before 1.1.1t; 3.0.0 to before 3.0.8 Vulnerable ·OpenSSL
  • cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.3.16; 4.4.0 to before 4.6.3 Vulnerable ·Stormshield

Remediation

  • Fix · CNA OpenSSL (OpenSSL) Fixed in 3.0.8, 1.1.1t
  • Fix · GHSA-v5w6-wcm8-jm4q openssl-src (crates.io) Fixed in 111.25.0 Advisory →
  • Fix · GHSA-v5w6-wcm8-jm4q openssl-src (crates.io) Fixed in 300.0.12 Advisory →

Red Hat 10 advisories

  • RHSA-2023:3420 Released 2023-06-05 · Red Hat rating Important
    Red Hat JBoss Web Server 5.7.3 release and security update
    • Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat-native-1.2.31-14.redhat_14.el7jws
    • Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-tomcat-native-1.2.31-14.redhat_14.el8jws
    • Red Hat JBoss Web Server 5.7 for RHEL 9 jws5-tomcat-native-1.2.31-14.redhat_14.el9jws
  • RHSA-2023:3421 Released 2023-06-05 · Red Hat rating Important
    Red Hat JBoss Web Server 5.7.3 release and security update
    • Red Hat JBoss Web Server 5
  • RHSA-2023:3354 Released 2023-06-05 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP2 security update
    • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-apr-util-1.6.1-101.el7jbcs, jbcs-httpd24-apr-util-devel-1.6.1-101.el7jbcs, jbcs-httpd24-apr-util-ldap-1.6.1-101.el7jbcs +23
    • Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-apr-util-1.6.1-101.el8jbcs, jbcs-httpd24-apr-util-devel-1.6.1-101.el8jbcs, jbcs-httpd24-apr-util-ldap-1.6.1-101.el8jbcs +23
Show 7 more Red Hat advisories
  • RHSA-2023:3355 Released 2023-06-05 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP2 security update
    • JBCS httpd 2.4.51.sp2
  • RHSA-2023:3408 Released 2023-05-31 · Red Hat rating Moderate
    openssl security update
    • Red Hat Enterprise Linux BaseOS EUS (v.8.6) openssl-1:1.1.1k-9.el8_6, openssl-devel-1:1.1.1k-9.el8_6, openssl-libs-1:1.1.1k-9.el8_6 +1
  • RHSA-2023:2932 Released 2023-05-16 · Red Hat rating Important
    edk2 security update
    • Red Hat Enterprise Linux AppStream (v. 8) edk2-20220126gitbb1bba3d77-4.el8, edk2-aarch64-20220126gitbb1bba3d77-4.el8, edk2-ovmf-20220126gitbb1bba3d77-4.el8
  • RHSA-2023:2165 Released 2023-05-09 · Red Hat rating Important
    edk2 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) edk2-20221207gitfff6d81270b5-9.el9_2, edk2-aarch64-20221207gitfff6d81270b5-9.el9_2, edk2-ovmf-20221207gitfff6d81270b5-9.el9_2
    • Red Hat Enterprise Linux CRB (v. 9) edk2-aarch64-20221207gitfff6d81270b5-9.el9_2, edk2-ovmf-20221207gitfff6d81270b5-9.el9_2, edk2-tools-20221207gitfff6d81270b5-9.el9_2 +1
  • RHSA-2023:1405 Released 2023-03-22 · Red Hat rating Important
    openssl security update
    • Red Hat Enterprise Linux BaseOS (v. 8) openssl-1:1.1.1k-9.el8_7, openssl-devel-1:1.1.1k-9.el8_7, openssl-libs-1:1.1.1k-9.el8_7 +1
  • RHSA-2023:1199 Released 2023-03-14 · Red Hat rating Important
    openssl security and bug fix update
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) openssl-devel-1:3.0.1-46.el9_0, openssl-perl-1:3.0.1-46.el9_0
    • Red Hat Enterprise Linux BaseOS EUS (v.9.0) openssl-1:3.0.1-46.el9_0, openssl-libs-1:3.0.1-46.el9_0
  • RHSA-2023:0946 Released 2023-02-28 · Red Hat rating Important
    openssl security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) openssl-devel-1:3.0.1-47.el9_1, openssl-perl-1:3.0.1-47.el9_1
    • Red Hat Enterprise Linux BaseOS (v. 9) openssl-1:3.0.1-47.el9_1, openssl-libs-1:3.0.1-47.el9_1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    OpenSSL — openssl.org/news/secadv/20230207.txt

    7 records Highest priority Priority HIGH 1 HIGH, 6 MEDIUM

    Other records, highest priority first

    • TI-2023-00271 X.400 address type confusion in X.509 GeneralNamePriority HIGH 70
    • TI-2023-00208 Use-after-free following BIO_new_NDEFPriority MEDIUM 47
    • TI-2022-03942 Timing Oracle in RSA DecryptionPriority MEDIUM 47
    Show all 7 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat JBoss Web Server 3AffectedNo fix planned: Out of support scope
JBCS httpd 2.4.51.sp2Fixed RHSA-2023:3355
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:2932
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:0946, RHSA-2023:2165
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2023:1199
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2023:1405
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2023:0946
Red Hat Enterprise Linux BaseOS EUS (v.8.6)Fixed RHSA-2023:3408
Red Hat Enterprise Linux BaseOS EUS (v.9.0)Fixed RHSA-2023:1199
Red Hat Enterprise Linux CRB (v. 9)Fixed RHSA-2023:2165
Red Hat JBoss Core Services on RHEL 7 ServerFixed RHSA-2023:3354
Red Hat JBoss Core Services on RHEL 8Fixed RHSA-2023:3354
Red Hat JBoss Web Server 5Fixed RHSA-2023:3421
Red Hat JBoss Web Server 5.7 for RHEL 7 ServerFixed RHSA-2023:3420
Red Hat JBoss Web Server 5.7 for RHEL 8Fixed RHSA-2023:3420
Red Hat JBoss Web Server 5.7 for RHEL 9Fixed RHSA-2023:3420
Not affected: 6 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Core Services on RHEL 7 Server
  • Red Hat JBoss Core Services on RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-4450
  2. 2026-10-03 Alias added: GHSA-v5w6-wcm8-jm4q
  3. 2026-10-09 Fix available: RHSA-2023:3355 · Red Hat
  4. 2026-10-16 Fix available: JBCS httpd 2.4.51.sp2 · Red Hat

References

Patch 2

Advisory 2

Other 3

  • TI-2022-01915 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
  • TI-2021-02645 SM2 Decryption Buffer Overflow CVSS 3.1CRITICAL 9.8
  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
  • TI-2022-01176 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
  • TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
  • TI-2025-14107 Stack buffer overflow in CMS (Auth)EnvelopedData parsing CVSS 3.1HIGH 8.8
See all 312 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences