OpenSSL up to 3.0.7 X.509 Certificate Verification buffer overflow

Summaryinfo

A vulnerability was found in OpenSSL up to 3.0.7. It has been classified as critical. Affected is an unknown function of the component X.509 Certificate Verification. This manipulation causes buffer overflow. This vulnerability is handled as CVE-2022-4203. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in OpenSSL up to 3.0.7 (Network Encryption Software) and classified as critical. Affected by this vulnerability is an unknown code block of the component X.509 Certificate Verification. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. The read buffer overrun might result in a crash which could lead to a denial of service attack. In theory it could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext) although we are not aware of any working exploit leading to memory contents disclosure as of the time of release of this advisory. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.

The weakness was released 02/07/2023. It is possible to read the advisory at openssl.org. This vulnerability is known as CVE-2022-4203. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 11/06/2025).

The vulnerability scanner Nessus provides a plugin with the ID 211573 (Oracle Linux 9 : openssl / and / openssl-fips-provider (ELSA-2024-9333)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.0.8 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (211573). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Network Encryption Software

Name

• OpenSSL

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7

License

• open-source

Website

• Product: https://www.openssl.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion