Vulnerability 239161 - CERT Civis.Net

Vulnerability Name:

CCN-239161

Published:

2022-11-01

Updated:

2022-11-01

Summary:

OpenSSL is vulnerable to a stack-based buffer overflow, caused by improper bounds checking during X.509 certificate verification. By using a specially-crafted email address, a remote attacker could overflow a buffer and execute arbitrary code or cause the application to crash.

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
6.4 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Consequences:

Gain Access

References:

Source: XF
Type: UNKNOWN
openssl-cve20223602-bo(239161)

Source: CCN
Type: Packet Storm Security [11-02-2022]
OpenSSL Toolkit 3.0.7 OpenSSL Toolkit 3.0.7

Source: CCN
Type: Packet Storm Security [11-01-2022]
OpenSSL Security Advisory 20221101 OpenSSL Security Advisory 20221101

Source: CCN
Type: IBM Security Bulletin 6837195 (MQ)
IBM MQ Advanced Message Security on IBM i platforms is affected by a buffer overflow issue in OpenSSL (CVE-2022-3602, CVE-2022-3786)

Source: CCN
Type: IBM Security Bulletin 6837817 (Cloud Application Business Insights)
OpenSSL vulnerabilities might impact IBM Cloud Application Business Insights - CVE-2022-3602 & CVE-2022-3786

Source: CCN
Type: IBM Security Bulletin 6846293 (API Connect)
API Connect is impacted by a vulnerability in OpenSSL (CVE-2022-3602, CVE-2022-3786)

Source: CCN
Type: IBM Security Bulletin 6854981 (Cloud Pak for Security)
IBM Cloud Pak for Security includes components with multiple known vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6857295 (AIX)
Multiple vulnerabilities in OpenSSL affect AIX

Source: CCN
Type: IBM Security Bulletin 6952305 (Aspera faspio Gateway)
IBM Aspera faspio Gateway affected by OpenSSL vulnerabilities (CVE-2022-3602, CVE-2022-3786)

Source: CCN
Type: IBM Security Bulletin 6956311 (Cloud Pak for Multicloud Management)
Multiple Vulnerabilities in Multicloud Management Security Services

Source: CCN
Type: IBM Security Bulletin 6958062 (Cloud Pak for Business Automation)
Security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for Febuary 2023

Source: CCN
Type: IBM Security Bulletin 6960495 (Observability with Instana)
IBM Observability with Instana (OnPrem) affected by OpenSSL vulnerabilities.

Source: CCN
Type: IBM Security Bulletin 6999285 (Spectrum Protect Plus Db2 Agent)
Vulnerabilities in OpenSSL may affect IBM Spectrum Protect Plus (CVE-2022-3602, CVE-2022-3786)

Source: CCN
Type: OpenSSL Web site
Fixed in OpenSSL 3.0

Vulnerable Configuration:

Configuration CCN 1:

cpe:/a:openssl:openssl:3.0.0:*:*:*:*:*:*:*

OR cpe:/a:openssl:openssl:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:openssl:openssl:3.0.2:*:*:*:*:*:*:*

OR cpe:/a:openssl:openssl:3.0.3:*:*:*:*:*:*:*

OR cpe:/a:openssl:openssl:3.0.4:*:*:*:*:*:*:*

OR cpe:/a:openssl:openssl:3.0.5:*:*:*:*:*:*:*

OR cpe:/a:openssl:openssl:3.0.6:*:*:*:*:*:*:*

AND

cpe:/a:ibm:api_connect:10.0.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:api_connect:10.0.1.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_business_automation:18.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_business_automation:18.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_business_automation:19.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_business_automation:19.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_business_automation:20.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_business_automation:20.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_business_automation:21.0.1:-:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_business_automation:21.0.2:-:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_business_automation:21.0.3:-:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_business_automation:22.0.1:-:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_security:1.10.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_security:1.10.6.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_business_automation:22.0.2:-:*:*:*:*:*:*

OR cpe:/a:ibm:observability_with_instana:239-2:*:*:*:*:*:*:*

OR cpe:/a:ibm:observability_with_instana:241-2:*:*:*:*:*:*:*

Denotes that component is vulnerable