Skip to content
Fencer Vulns
high 7.5

CVE-2022-3786 in the critical feed json

X.509 Email Address Variable Length Buffer Overflow

published 2022-11-01 4 y ago modified 2026-10-16 23 d ago also BIT-node-2022-3786 , BIT-node-min-2022-3786 , EUVD-2022-7358 , GHSA-h8jm-2x53-xhp5 , RUSTSEC-2022-0065

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
92.5%
EPSS 92.5% chance of exploitation in 30 days, percentile 99.8%
public exploits
0
none known

Summary

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.

Patch / fix

  • crates.io openssl-src 300.0.11
  • bitnami node 18.11.0, 18.12.1, 19.0.1
  • bitnami node-min 18.11.0, 18.12.1, 19.0.1
  • OpenSSL OpenSSL 3.0.7
  • Siemens Calibre ICE V2023.1
  • Siemens Mcenter V5.3.0
  • Siemens SCALANCE X204RNA (HSR) V3.2.8
  • Siemens SCALANCE X204RNA (PRP) V3.2.8
  • Siemens SCALANCE X204RNA EEC (HSR) V3.2.8
  • Siemens SCALANCE X204RNA EEC (PRP) V3.2.8
  • Siemens SCALANCE X204RNA EEC (PRP/HSR) V3.2.8
  • Siemens SICAM GridPass V2.20
  • Siemens SIMATIC RTLS Locating Manager V2.13.0.3
  • openssl Debian 14, Debian 13, Debian 12 3.0.7-1

debian advisories DEBIAN-CVE-2022-3786

  • openssl Ubuntu 22.04 LTS 3.0.2-0ubuntu1.7

ubuntu advisories UBUNTU-CVE-2022-3786

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openssl RHEL 9 1:3.0.1-43.el9_0
  • openssl-libs RHEL 9 1:3.0.1-43.el9_0
  • openssl-perl RHEL 9 1:3.0.1-43.el9_0

red hat advisories RHSA-2022:7288

  • openssl-3 SLE Module for Basesystem 15 SP4, openSUSE Leap 15.4 3.0.1-150400.4.14.1
  • openssl-3 SLE Module for Basesystem 15 SP4, openSUSE Leap 15.4 3.0.1-150400.4.11.1

suse advisories SUSE-SU-2022:4586-1SUSE-SU-2022:3843-1

  • python-cryptography openSUSE Tumbleweed 44.0.0-1.1
  • python-cryptography-vectors openSUSE Tumbleweed 44.0.0-1.1
  • cargo-audit-advisory-db openSUSE Tumbleweed 20221102-1.1
  • openssl-3 openSUSE Tumbleweed 3.0.7-1.1
  • python-cryptography openSUSE Tumbleweed 38.0.3-1.1

opensuse advisories openSUSE-SU-2025:14739-1openSUSE-SU-2025:14740-1openSUSE-SU-2024:12469-1openSUSE-SU-2024:12475-1openSUSE-SU-2024:12479-1openSUSE-SU-2024:12480-1

  • openssl AlmaLinux 9 1:3.0.1-43.el9_0
  • openssl-libs AlmaLinux 9 1:3.0.1-43.el9_0
  • openssl-perl AlmaLinux 9 1:3.0.1-43.el9_0

almalinux advisories ALSA-2022:7288

  • openssl Rocky Linux 9 1:3.0.1-43.el9_0

rocky linux advisories RLSA-2022:7288

  • nodejs Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 18.12.1-r0
  • openssl Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 3.0.7-r0
  • openssl3 Alpine 3.16, Alpine 3.15 3.0.7-r0

alpine advisories ALPINE-CVE-2022-3786

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-3786 updated cvss 7.5

OpenSSL: X.509 Email Address Variable Length Buffer Overflow

  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/fluentd-rhel8
    under investigation
  • Red Hat Enterprise Linux AppStream (v. 9) ubi9/openssl 9.0-25, rhel9/openssl 9.0-25, openssl-perl 3.0.1-43.el9_0 Red Hat Enterprise Linux BaseOS (v. 9) openssl 3.0.1-43.el9_0, openssl-libs 3.0.1-43.el9_0
    fixed: vendor fix RHSA-2022:7288
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/management-ingress-rhel8 Red Hat Enterprise Linux 6 openssl, openssl098e, openssl-perl Red Hat Enterprise Linux 7 ovmf, OVMF, AAVMF, openssl, openssl098e, openssl-libs, +1 more Red Hat Enterprise Linux 8 edk2, shim, openssl, shim-x64, edk2-ovmf, shim-aa64, +5 more Red Hat Enterprise Linux 9 edk2, shim, shim-x64, edk2-ovmf, shim-aa64, edk2-tools, +2 more Red Hat JBoss Core Services jbcs-httpd24-openssl jbcs-httpd24-openssl
    +4 more products
    Red Hat JBoss Enterprise Application Platform 6 openssl Red Hat JBoss Web Server 3 openssl Red Hat JBoss Web Server 5 openssl Red Hat Virtualization 4 redhat-virtualization-host-image-update
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-22-349-09 updated cvss 7.5

Siemens Products affected by OpenSSL 3.0

  • Siemens Calibre ICE >= 2022.4, < 2023.1
    affected: fixed in V2023.1, mitigation
  • Siemens Mcenter >= 5.2.1, < 5.3.0
    affected: fixed in V5.3.0, mitigation download.industrysoftware.automation.siemens.com
  • Siemens SCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2) >= 3.2.7, < 3.2.8 Siemens SCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2) >= 3.2.7, < 3.2.8 Siemens SCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3) >= 3.2.7, < 3.2.8 Siemens SCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3) >= 3.2.7, < 3.2.8 Siemens SCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3) >= 3.2.7, < 3.2.8
    affected: fixed in V3.2.8, mitigation support.industry.siemens.com
  • Siemens SICAM GridPass >= 1.80, < 2.20
    affected: fixed in V2.20, mitigation support.industry.siemens.com
  • Siemens SIMATIC RTLS Locating Manager >= 2.13.0.0, < 2.13.0.3
    affected: fixed in V2.13.0.3, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-22-349-10 updated cvss 7.5

Siemens APOGEE/TALON Field Panels

  • Siemens Calibre ICE >=V2022.4<V2023.1
    affected: fixed in V2023.1, mitigation support.sw.siemens.com
  • Siemens Mcenter >=V5.2.1.0
    affected: mitigation, no fix available “Ensure that only trusted (CA) certificates are contained in the Machine Agent's truststore”
  • Siemens SCALANCE X-200RNA switch family >=V3.2.7
    affected: mitigation, no fix available “Currently no fix is available”
  • Siemens SICAM GridPass (6MD7711-2AA00-1EA0) >=V1.80<V2.20
    affected: fixed in V2.20, mitigation support.industry.siemens.com
  • Siemens SIMATIC RTLS Locating Manager (6GT2780-0DA00) >=V2.13
    affected: mitigation, no fix available “Currently no fix is available”

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-22-349-12 updated cvss 7.5

Siemens Parasolid

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-229-01 updated cvss 5.9

ICONICS and Mitsubishi Electric Products

  • ICONICS, Mitsubishi Electric ICONICS Suite including GENESIS64, Hyper Historian, AnalytiX, and MobileHMI 10.97.2
    affected: mitigation “Version 10.97.2 Critical Fixes Rollup 2 and later is not vulnerable to these exploits. ICONICS recommends that users of its products take the following mitigation steps:” partners.iconics.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-23-019-01 updated cvss 7.5

Hitachi Energy PCU400

  • Hitachi Energy PCU400 >= 9.3.0 - but not including 9.3.8 Hitachi Energy PCULogger tool 1.0.1
    affected: vendor fix, mitigation “Hitachi Energy has fixed the vulnerabilities in the following versions, and recommends users update their systems to the appropriate version:” search.abb.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-23-005-03 updated cvss 7.5

Hitachi Energy Lumada Asset Performance Management

  • Hitachi Energy Lumada APM 6.5.0.0
    affected: mitigation “For all listed vulnerabilities: Lumada APM Version 6.5.0.1 or later.” search.abb.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

92.49% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
crates.io openssl-src
>=300.0.0, <300.0.11
300.0.11
bitnami node
>=18.0.0, <18.11.0
>=18.12.0, <18.12.1
>=19.0.0, <19.0.1
18.11.0
18.12.1
19.0.1
bitnami node-min
>=18.0.0, <18.11.0
>=18.12.0, <18.12.1
>=19.0.0, <19.0.1
18.11.0
18.12.1
19.0.1

Affected products

  • OpenSSL OpenSSL
  • Siemens Calibre ICE
  • Siemens Mcenter
  • Siemens SCALANCE X204RNA (HSR)
  • Siemens SCALANCE X204RNA (PRP)
  • Siemens SCALANCE X204RNA EEC (HSR)
  • Siemens SCALANCE X204RNA EEC (PRP)
  • Siemens SCALANCE X204RNA EEC (PRP/HSR)
  • Siemens SICAM GridPass
  • Siemens SIMATIC RTLS Locating Manager

Classification

Weakness
  • CWE-120 Buffer Copy without Checking Size of Input
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.