OpenSSL buffer overflow vulnerability warning

Respectful master's command:

   Hello! OpenSSL officially released a security bulletin, disclosing that there are two high-risk buffer overflow vulnerabilities (CVE-2022-3602, CVE-2022-3786) in version 3.0.x, which can lead to denial of service and other hazards, and may lead to remote code execution under certain circumstances.

[Vulnerability Rating]

High risk

[Vulnerability description]

CVE-2022-3602、CVE-2022-3786

OpenSSL is a Secure Sockets Layer cryptographic library commonly used for encryption and secure communications. The two vulnerabilities are due to flaws in the X.509 certificate verification in OpenSSL. An attacker can trigger a buffer overflow by crafting a malicious email address. Successful exploitation of the vulnerability can lead to a denial of service or potential remote code execution.

[scope of influence]

affected version

3.0.0 <= OpenSSL < =3.0.6

[Repair Plan]

You can use the “openssl version” or “openssl version -a” command to view the currently installed openssl version. If the version you are using is potentially threatened by vulnerabilities, please upgrade to a safe version as soon as possible:

https://www.openssl.org/source/

[Reference link]

https://www.openssl.org/news/secadv/20221101.txt

https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/