| Vulnerability Name: | CVE-2022-3358 (CCN-238264) | ||||||||||||
| Assigned: | 2022-10-11 | ||||||||||||
| Published: | 2022-10-11 | ||||||||||||
| Updated: | 2022-12-13 | ||||||||||||
| Summary: | OpenSSL could allow a remote attacker to obtain sensitive information, caused by the improper handling of legacy custom ciphers passed
to the EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() and EVP_CipherInit_ex2() functions. By creating a custom cipher with NID_undef using the legacy EVP_CIPHER_meth_new()function, a remote attacker could exploit this vulnerability force the use of a NULL cipher and emit the plaintext as the ciphertext. | ||||||||||||
| CVSS v3 Severity: | 7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) 6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C)
| ||||||||||||
| CVSS v2 Severity: | 5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
| ||||||||||||
| Vulnerability Consequences: | Obtain Information | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2022-3358 Source: XF Type: UNKNOWN openssl-cve20223358-info-disc(238264) Source: openssl-security@openssl.org Type: Mailing List, Patch, Vendor Advisory openssl-security@openssl.org Source: CCN Type: Packet Storm Security [11-11-2022] OpenSSL Security Advisory 20221011 OpenSSL Security Advisory 20221011 Source: openssl-security@openssl.org Type: Third Party Advisory openssl-security@openssl.org Source: openssl-security@openssl.org Type: Third Party Advisory openssl-security@openssl.org Source: CCN Type: IBM Security Bulletin 6857295 (AIX) Multiple vulnerabilities in OpenSSL affect AIX Source: CCN Type: IBM Security Bulletin 7014451 (App Connect Enterprise Certified Container) IBM App Connect Enterprise Certified Container Dashboard operands are vulnerable to denial of service and loss of confidentiality due to multiple vulnerabilities Source: CCN Type: Mend Vulnerability Database CVE-2022-3358 Source: CCN Type: OpenSSL Security Advisory [11 October 2022] OpenSSL Security Advisory [11 October 2022] Source: openssl-security@openssl.org Type: Vendor Advisory openssl-security@openssl.org | ||||||||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||||||||
| Oval Definitions | |||||||||||||
| |||||||||||||
| BACK | |||||||||||||