The vulnerability is a memory corruption bug that can be triggered when a vulnerable client or server validates an X.509 certificate. On November 1, 2022, the OpenSSL Project released a security bulletin detailing a vulnerability they deemed high severity. OpenSSL 1.1.1 and 1.0.2 are NOT vulnerable.Some application runtimes, such as Node.js, embed their own version of OpenSSL and need to be upgraded as well.

OpenSSL 3.0.x users should upgrade to 3.0.7.

There still is a possibility that an exploit crafted for Linux deployments emerges.

Linux deployments are potentially vulnerable, but due to technical details discovered during our research, they may not be exploitable.

Datadog has released a proof of concept (PoC) to crash a Windows deployment of vulnerable versions.

Use of OpenSSL 3.x is consequently not as widespread, which is likely to further limit exploitation of this vulnerability.

OpenSSL 3.x was released in September 2021, while 1.1.1 is an LTS version supported until September 2023.

This vulnerability is likely not as open to widespread exploitation as HeartBleed due to the prerequisite that a client or server must be configured to verify a malicious email address within a certificate.

The vulnerable function patched in 3.0.7 requires a victim client or server to verify a maliciously crafted email address within an X.509 certificate.

The vulnerability was fixed in version 3.0.7, released November 1, 2022.

The vulnerability affects OpenSSL versions 3.0.0 (released in September 2021) to 3.0.6 (included).

The issue was reported to the OpenSSL Project on October 17, 2022.

This post focuses on the initially announced vulnerability solely. On November 1, the OpenSSL project announced that the 3.0.7 release also fixed another vulnerability, CVE-2022-3786.

The initial vulnerability pre-announced by OpenSSL is CVE-2022-3602.

The vulnerability was initially pre-announced as “critical”, and later downgraded to “high”.We will update this blog as we discover more details via our own research and publicly available information. There is a lot of coverage of this vulnerability from sources such as news stories and social media posts, and information is changing quickly. a deep-dive technical analysis of the vulnerability, its exploit path, and our efforts in exploiting the vulnerability.our assessment of the vulnerability’s exploitability and impact as they relate to the scenarios necessary to reach the vulnerable code path.protection and detection recommendations.the main takeaways from Datadog Security Lab’s research into the vulnerability.The vulnerability is tracked as CVE-2022-3602. Deployments of OpenSSL from 3.0.0 to 3.0.6 (included) are vulnerable and are fixed in version 3.0.7. On November 1, 2022, the OpenSSL Project released a security advisory detailing a high-severity vulnerability in the OpenSSL library.

Openssl buffer overflow