Connexion Inscription
JA · EN · FR
SecPulse
Catégories
CVE-2022-3786

X.509 Email Address Variable Length Buffer Overflow

Résumé

X.509 Email Address Variable Length Buffer Overflow

Description d'origine

La description telle que publiée par la source (souvent en anglais).

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Paquets affectés

crates.io openssl-src
[{"type":"SEMVER","events":[{"introduced":"300.0.0"},{"fixed":"300.0.11"}]}]
Bitnami node
[{"type":"SEMVER","events":[{"introduced":"18.0.0"},{"fixed":"18.11.0"},{"introduced":"18.12.0"},{"fixed":"18.12.1"},{"introduced":"19.0.0"},{"fixed":"19.0.1"}]}]
Bitnami node-min
[{"type":"SEMVER","events":[{"introduced":"18.0.0"},{"fixed":"18.11.0"},{"introduced":"18.12.0"},{"fixed":"18.12.1"},{"introduced":"19.0.0"},{"fixed":"19.0.1"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Références

Nous utilisons des cookies pour l'analyse d'audience et la mesure publicitaire. Ce réglage s'applique à tous les sites de Game co., Ltd. En savoir plus