Skip to content
Fencer Vulns
high 7.5

CVE-2022-3602 in the critical feed json

X.509 Email Address 4-byte Buffer Overflow

published 2022-11-01 4 y ago modified 2026-10-16 23 d ago also BIT-node-2022-3602 , BIT-node-min-2022-3602 , EUVD-2022-7287 , GHSA-8rwr-x37p-mx23 , RUSTSEC-2022-0064

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
90.8%
EPSS 90.8% chance of exploitation in 30 days, percentile 99.8%
public exploits
0
none known

Summary

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6).

Patch / fix

  • crates.io openssl-src 300.0.11
  • bitnami node 18.11.0, 18.12.1, 19.0.1
  • bitnami node-min 18.11.0, 18.12.1, 19.0.1
  • Siemens Calibre ICE V2023.1
  • Siemens Mcenter V5.3.0
  • Siemens SCALANCE X204RNA (HSR) V3.2.8
  • Siemens SCALANCE X204RNA (PRP) V3.2.8
  • Siemens SCALANCE X204RNA EEC (HSR) V3.2.8
  • Siemens SCALANCE X204RNA EEC (PRP) V3.2.8
  • Siemens SCALANCE X204RNA EEC (PRP/HSR) V3.2.8
  • Siemens SICAM GridPass V2.20
  • Siemens SIMATIC RTLS Locating Manager V2.13.0.3
  • openssl Debian 14, Debian 13, Debian 12 3.0.7-1

debian advisories DEBIAN-CVE-2022-3602

  • openssl Ubuntu 22.04 LTS 3.0.2-0ubuntu1.7

ubuntu advisories UBUNTU-CVE-2022-3602

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openssl RHEL 9 1:3.0.1-43.el9_0
  • openssl-libs RHEL 9 1:3.0.1-43.el9_0
  • openssl-perl RHEL 9 1:3.0.1-43.el9_0

red hat advisories RHSA-2022:7288

  • openssl-3 SLE Module for Basesystem 15 SP4, openSUSE Leap 15.4 3.0.1-150400.4.11.1

suse advisories SUSE-SU-2022:3843-1

  • python-mitmproxy openSUSE Tumbleweed 11.1.2-1.1
  • python-cryptography openSUSE Tumbleweed 44.0.0-1.1
  • python-cryptography-vectors openSUSE Tumbleweed 44.0.0-1.1
  • cargo-audit-advisory-db openSUSE Tumbleweed 20221102-1.1
  • openssl-3 openSUSE Tumbleweed 3.0.7-1.1
  • python-cryptography openSUSE Tumbleweed 38.0.3-1.1

opensuse advisories openSUSE-SU-2025:14762-1openSUSE-SU-2025:14739-1openSUSE-SU-2025:14740-1openSUSE-SU-2024:12469-1openSUSE-SU-2024:12475-1openSUSE-SU-2024:12479-1

  • openssl AlmaLinux 9 1:3.0.1-43.el9_0
  • openssl-libs AlmaLinux 9 1:3.0.1-43.el9_0
  • openssl-perl AlmaLinux 9 1:3.0.1-43.el9_0

almalinux advisories ALSA-2022:7288

  • openssl Rocky Linux 9 1:3.0.1-43.el9_0

rocky linux advisories RLSA-2022:7288

  • nodejs Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 18.12.1-r0
  • openssl Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 3.0.7-r0
  • openssl3 Alpine 3.16, Alpine 3.15 3.0.7-r0

alpine advisories ALPINE-CVE-2022-3602

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-3602 updated cvss 7.5

OpenSSL: X.509 Email Address Buffer Overflow

  • Red Hat Enterprise Linux AppStream (v. 9) ubi9/openssl 9.0-25, rhel9/openssl 9.0-25, openssl-perl 3.0.1-43.el9_0 Red Hat Enterprise Linux BaseOS (v. 9) openssl 3.0.1-43.el9_0, openssl-libs 3.0.1-43.el9_0
    fixed: vendor fix RHSA-2022:7288
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/management-ingress-rhel8 Red Hat Enterprise Linux 6 openssl, openssl098e, openssl-perl Red Hat Enterprise Linux 7 ovmf, OVMF, AAVMF, openssl, openssl098e, openssl-libs, +1 more Red Hat Enterprise Linux 8 edk2, shim, openssl, shim-x64, edk2-ovmf, shim-aa64, +5 more Red Hat Enterprise Linux 9 edk2, shim, shim-x64, edk2-ovmf, shim-aa64, edk2-tools, +2 more Red Hat JBoss Core Services jbcs-httpd24-openssl jbcs-httpd24-openssl
    +4 more products
    Red Hat JBoss Enterprise Application Platform 6 openssl Red Hat JBoss Web Server 3 openssl Red Hat JBoss Web Server 5 openssl Red Hat Virtualization 4 redhat-virtualization-host-image-update
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-22-349-09 updated cvss 7.5

Siemens Products affected by OpenSSL 3.0

  • Siemens Calibre ICE >= 2022.4, < 2023.1
    affected: fixed in V2023.1, mitigation
  • Siemens Mcenter >= 5.2.1, < 5.3.0
    affected: fixed in V5.3.0, mitigation download.industrysoftware.automation.siemens.com
  • Siemens SCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2) >= 3.2.7, < 3.2.8 Siemens SCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2) >= 3.2.7, < 3.2.8 Siemens SCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3) >= 3.2.7, < 3.2.8 Siemens SCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3) >= 3.2.7, < 3.2.8 Siemens SCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3) >= 3.2.7, < 3.2.8
    affected: fixed in V3.2.8, mitigation support.industry.siemens.com
  • Siemens SICAM GridPass >= 1.80, < 2.20
    affected: fixed in V2.20, mitigation support.industry.siemens.com
  • Siemens SIMATIC RTLS Locating Manager >= 2.13.0.0, < 2.13.0.3
    affected: fixed in V2.13.0.3, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-22-349-10 updated cvss 7.5

Siemens APOGEE/TALON Field Panels

  • Siemens Calibre ICE >=V2022.4<V2023.1
    affected: fixed in V2023.1, mitigation support.sw.siemens.com
  • Siemens Mcenter >=V5.2.1.0
    affected: mitigation, no fix available “Ensure that only trusted (CA) certificates are contained in the Machine Agent's truststore”
  • Siemens SCALANCE X-200RNA switch family >=V3.2.7
    affected: mitigation, no fix available “Currently no fix is available”
  • Siemens SICAM GridPass (6MD7711-2AA00-1EA0) >=V1.80<V2.20
    affected: fixed in V2.20, mitigation support.industry.siemens.com
  • Siemens SIMATIC RTLS Locating Manager (6GT2780-0DA00) >=V2.13
    affected: mitigation, no fix available “Currently no fix is available”

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-22-349-12 updated cvss 7.5

Siemens Parasolid

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-229-01 updated cvss 5.9

ICONICS and Mitsubishi Electric Products

  • ICONICS, Mitsubishi Electric ICONICS Suite including GENESIS64, Hyper Historian, AnalytiX, and MobileHMI 10.97.2
    affected: mitigation “Version 10.97.2 Critical Fixes Rollup 2 and later is not vulnerable to these exploits. ICONICS recommends that users of its products take the following mitigation steps:” partners.iconics.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-23-019-01 updated cvss 7.5

Hitachi Energy PCU400

  • Hitachi Energy PCU400 >= 9.3.0 - but not including 9.3.8 Hitachi Energy PCULogger tool 1.0.1
    affected: vendor fix, mitigation “Hitachi Energy has fixed the vulnerabilities in the following versions, and recommends users update their systems to the appropriate version:” search.abb.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-23-005-03 updated cvss 7.5

Hitachi Energy Lumada Asset Performance Management

  • Hitachi Energy Lumada APM 6.5.0.0
    affected: mitigation “For all listed vulnerabilities: Lumada APM Version 6.5.0.1 or later.” search.abb.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

90.77% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
crates.io openssl-src
>=300.0.0, <300.0.11
300.0.11
bitnami node
>=18.0.0, <18.11.0
>=18.12.0, <18.12.1
>=19.0.0, <19.0.1
18.11.0
18.12.1
19.0.1
bitnami node-min
>=18.0.0, <18.11.0
>=18.12.0, <18.12.1
>=19.0.0, <19.0.1
18.11.0
18.12.1
19.0.1

Affected products

  • OpenSSL OpenSSL
  • Siemens Calibre ICE
  • Siemens Mcenter
  • Siemens SCALANCE X204RNA (HSR)
  • Siemens SCALANCE X204RNA (PRP)
  • Siemens SCALANCE X204RNA EEC (HSR)
  • Siemens SCALANCE X204RNA EEC (PRP)
  • Siemens SCALANCE X204RNA EEC (PRP/HSR)
  • Siemens SICAM GridPass
  • Siemens SIMATIC RTLS Locating Manager

Classification

Weakness
  • CWE-787 Out-of-bounds Write
  • CWE-120 Buffer Copy without Checking Size of Input
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.