CVE-2022-3996
Fixed in a distro release EPSS 1%CVSS 7.5
If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy processing being enabled on a publicly facing server is not considered to be a common setup. Policy processing is enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. Update (31 March 2023): The description of the policy processing enablement was corrected based on CVE-2023-0466.
Products: OpenSSL, netapp ontap_9, netapp fas\/aff_baseboard_management_controller, netapp management_services_for_element_software, NetApp AltaVault OST Plug-in, netapp hci_baseboard_management_controller, netapp smi-s_provider
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| crates.io | openssl-src | 300.0.12 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.15 | openssl3 | 3.0.8-r0 |
| Alpine 3.16 | openssl3 | 3.0.8-r0 |
| Alpine 3.17 | openssl | 3.0.7-r2 |
| Alpine 3.18 | openssl | 3.0.7-r2 |
| Alpine 3.19 | openssl | 3.0.7-r2 |
| Alpine 3.20 | openssl | 3.0.7-r2 |
| Alpine 3.21 | openssl | 3.0.7-r2 |
| Alpine 3.22 | openssl | 3.0.7-r2 |
| Alpine 3.23 | openssl | 3.0.7-r2 |
| Alpine 3.24 | openssl | 3.0.7-r2 |
| Amazon Linux 2023 | openssl | 1:3.0.5-1.amzn2023.0.7 |
| Amazon Linux 2023 | openssl-devel | 1:3.0.5-1.amzn2023.0.7 |
| Amazon Linux 2023 | openssl-libs | 1:3.0.5-1.amzn2023.0.7 |
| Amazon Linux 2023 | openssl-perl | 1:3.0.5-1.amzn2023.0.7 |
| Chainguard | openssl | 3.0.7-r1 |
| Chainguard | openssl-provider-fips | 3.0.8-r0 |
| Chainguard | ruby-3.1 | 0 |
| Debian 12 | openssl | 3.0.7-2 |
| Debian 13 | openssl | 3.0.7-2 |
| Debian 14 | openssl | 3.0.7-2 |
| SUSE Linux Enterprise Module for Basesystem 15 SP4 | openssl-3 | 3.0.1-150400.4.14.1 |
| Ubuntu 18.04 LTS | openssl | 1.1.1-1ubuntu2.1~18.04.22 |
| Ubuntu 18.04 LTS | openssl1.0 | 1.0.2n-1ubuntu5.12 |
| Ubuntu 20.04 LTS | openssl | 1.1.1f-1ubuntu2.18 |
| Ubuntu 22.04 LTS | openssl | 3.0.2-0ubuntu1.9 |
| Ubuntu Pro 14.04 LTS | openssl | 1.0.1f-1ubuntu2.27+esm7 |
| Ubuntu Pro 16.04 LTS | edk2 | no fix |
| Ubuntu Pro 16.04 LTS | openssl | 1.0.2g-1ubuntu4.20+esm7 |
| Wolfi | openssl | 3.0.7-r1 |
| Wolfi | ruby-3.1 | 0 |
| openSUSE Leap 15.4 | openssl-3 | 3.0.1-150400.4.14.1 |
| openSUSE Tumbleweed | openssl-3 | 3.0.7-2.1 |