CVE-2022-3996

If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy processing being enabled on a publicly facing server is not considered to be a common setup. Policy processing is enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. Update (31 March 2023): The description of the policy processing enablement was corrected based on CVE-2023-0466.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/openssl/openssl/commit/7725e7bfe6f2ce8146b6552b44e0d226be7638e7	Patch Third Party Advisory
https://www.openssl.org/news/secadv/20221213.txt	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-12-13 16:15

Updated : 2023-11-07 03:52

NVD link : CVE-2022-3996

Mitre link : CVE-2022-3996

CVE.ORG link : CVE-2022-3996

JSON object : View

Products Affected

openssl

openssl

CWE

CWE-667

Improper Locking

{"id": "CVE-2022-3996", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-12-13T16:15:22.007", "references": [{"url": "https://github.com/openssl/openssl/commit/7725e7bfe6f2ce8146b6552b44e0d226be7638e7", "tags": ["Patch", "Third Party Advisory"], "source": "openssl-security@openssl.org"}, {"url": "https://www.openssl.org/news/secadv/20221213.txt", "tags": ["Vendor Advisory"], "source": "openssl-security@openssl.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-667"}]}, {"type": "Secondary", "source": "openssl-security@openssl.org", "description": [{"lang": "en", "value": "CWE-667"}]}], "descriptions": [{"lang": "en", "value": "If an X.509 certificate contains a malformed policy constraint and\npolicy processing is enabled, then a write lock will be taken twice\nrecursively. On some operating systems (most widely: Windows) this\nresults in a denial of service when the affected process hangs. Policy\nprocessing being enabled on a publicly facing server is not considered\nto be a common setup.\n\nPolicy processing is enabled by passing the `-policy'\nargument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function.\n\nUpdate (31 March 2023): The description of the policy processing enablement\nwas corrected based on CVE-2023-0466."}, {"lang": "es", "value": "Si un certificado X.509 contiene una restricci\u00f3n de pol\u00edtica con formato incorrecto y el procesamiento de pol\u00edticas est\u00e1 habilitado, se aplicar\u00e1 un bloqueo de escritura dos veces de forma recursiva. En algunos sistemas operativos (m\u00e1s ampliamente: Windows), esto resulta en una Denegaci\u00f3n de Servicio (DoS) cuando el proceso afectado se bloquea. La habilitaci\u00f3n del procesamiento de pol\u00edticas en un servidor p\u00fablico no se considera una configuraci\u00f3n com\u00fan. El procesamiento de pol\u00edticas se habilita pasando el argumento `-policy' a las utilidades de l\u00ednea de comando o llamando a la funci\u00f3n `X509_VERIFY_PARAM_set1_policies()'. Actualizaci\u00f3n (31 de marzo de 2023): la descripci\u00f3n de la habilitaci\u00f3n del procesamiento de pol\u00edticas se corrigi\u00f3 seg\u00fan CVE-2023-0466."}], "lastModified": "2023-11-07T03:52:05.457", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "26EF8A48-B8E5-4D4D-8054-445D65171EAC", "versionEndIncluding": "3.0.7", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "openssl-security@openssl.org"}