CVE-2022-3602
published 2022-11-01CVE-2022-3602: A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain…
PriorityP267high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
89.80%
99.8th percentile
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6).
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openssl | < openssl 3.0.7-1 (bookworm) | openssl 3.0.7-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | azure_sdk_for_c | — | — |
| msrc | microsoft_azure_kubernetes_service | — | — |
| msrc | vcpkg | — | — |
| nodejs | node.js | — | — |
| nodejs | node.js | — | — |
| nodejs | node.js | >= 18.0.0 < 18.11.0 | 18.11.0 |
| openssl | openssl | — | — |
| openssl | openssl | >= 0 < 3.0.7-1 | 3.0.7-1 |
| openssl | openssl | >= 0 < 3.0.7-1 | 3.0.7-1 |
| openssl | openssl | >= 0 < 3.0.7-1 | 3.0.7-1 |
| openssl | openssl | >= 0 < 3.0.2-0ubuntu1.7 | 3.0.2-0ubuntu1.7 |
| openssl | openssl | >= 3.0.0 < 3.0.7 | 3.0.7 |
| paloalto | cortex_data | — | — |
| paloalto | cortex_xdr | — | — |
| paloalto | cortex_xpanse | — | — |
| paloalto | cortex_xsoar | — | — |
| paloalto | globalprotect | — | — |
| paloalto | pan-os | — | — |
| paloalto | prisma_access | — | — |
| paloalto | prisma_cloud | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect vulnerable OpenSSL versions (3.0.0 through 3.0.6) using the openssl version command on Linux hosts ↗
- →Detect vulnerable OpenSSL on Amazon Linux using rpm or repoquery ↗
- →Detect vulnerable OpenSSL on Debian/Ubuntu using dpkg-query ↗
- →Detect vulnerable OpenSSL on RHEL/Fedora/Oracle/CentOS using rpm ↗
- →Scan Docker images for vulnerable OpenSSL using docker scan plugin ↗
- →Scan container images for vulnerable OpenSSL using Trivy SPDX output ↗
- →The vulnerability is triggered via a maliciously crafted email address in an X.509 certificate's name constraint field; focus TLS inspection on certificate Subject Alternative Name (SAN) email fields for punycode-encoded values ↗
- →The flaw is located in the punycode decoder component within OpenSSL libcrypto; monitor for crashes or anomalous behaviour in processes linked against libcrypto when processing TLS certificates ↗
- →For TLS servers, exploitation requires mTLS (client authentication) to be enabled; audit server configurations for client certificate request settings as a prioritisation signal ↗
- →Proof-of-concept exploits that crash OpenSSL (DoS) are publicly available; monitor for unexpected OpenSSL process crashes in TLS-terminating services ↗
- ·Only OpenSSL versions 3.0.0 through 3.0.6 are affected; OpenSSL 1.x is NOT impacted ↗
- ·Exploitation requires either a CA to have signed the malicious certificate, or the application to continue certificate verification despite path-building failure — unauthenticated exploitation is not possible ↗
- ·Many platforms implement stack overflow protections that mitigate RCE; the primary realistic impact is denial of service (crash) ↗
- ·As of the sources' writing, no working RCE exploits existed — only PoCs causing crashes; RCE exploitation requires specific per-target exploit development ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ghsa7.5HIGH
osv7.5HIGH
vendor_cisco7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Essbase Risk Matrix: Essbase Web Platform (OpenSSL) — CVE-2022-3602
vendor_oracle·2024-01-15·CVSS 7.5
CVE-2022-3602 [HIGH] Oracle Oracle Essbase Risk Matrix: Essbase Web Platform (OpenSSL) — CVE-2022-3602
Oracle Oracle Essbase Risk Matrix: Essbase Web Platform (OpenSSL) vulnerability
CVE: CVE-2022-3602
CVSS: 7.5
Protocol: TLS
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2024 (JAN 2024)
CISA ICS
ICONICS and Mitsubishi Electric Products
cisa_ics·2023-08-17·CVSS 7.5
[HIGH] ICONICS and Mitsubishi Electric Products
ICS Advisory
##
ICONICS and Mitsubishi Electric Products
Release DateAugust 17, 2023
Alert CodeICSA-23-229-01
## 1. EXECUTIVE SUMMARY
- CVSS v3 5.9
- ATTENTION: Exploitable remotely
- Vendor: ICONICS, Mitsubishi Electric
- Equipment: ICONICS Product Suite
- Vulnerabilities: Buffer Overflow, Out-of-Bounds Read, Observable Timing Discrepancy, Double Free, and NULL Pointer Dereference
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could result in information disclosure, denial-of-service, or remote code execution.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
ICONICS reports these vulnerabilities affect the following products using OpenSSL:
-
ICONICS Suite including GENESIS64, Hyper Historian, AnalytiX, and MobileHMI:
CISA ICS
Hitachi Energy PCU400
cisa_ics·2023-01-19·CVSS 7.5
[HIGH] Hitachi Energy PCU400
ICS Advisory
##
Hitachi Energy PCU400
Last RevisedJanuary 19, 2023
Alert CodeICSA-23-019-01
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.5
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Hitachi Energy
- Equipment: PCU400
- Vulnerabilities: Reliance on Uncontrolled Component
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could result in a denial-of-service condition on both the logging function of the device and its associated server.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
The following versions of PCU400, a network manager and process communication unit, are affected:
- PCU400: Versions 9.3.0 and later up to but not including 9.3.8
- PCULogger tool: Version 1.0.1
## 3.2 VULNERABILITY OVERVIEW
3.2.1 RELIANCE
CISA ICS
Hitachi Energy Lumada Asset Performance Management
cisa_ics·2023-01-05·CVSS 7.5
[HIGH] Hitachi Energy Lumada Asset Performance Management
ICS Advisory
##
Hitachi Energy Lumada Asset Performance Management
Last RevisedJanuary 05, 2023
Alert CodeICSA-23-005-03
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Hitachi Energy
- Equipment: Lumada Asset Performance Management (APM)
- Vulnerabilities: Classic Buffer Overflow, Out-of-bounds Write
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could cause a denial-of-service condition or unauthorized remote arbitrary code execution.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
The following versions of Lumada Asset Performance Management (APM), a web-based asset monitoring software deployable as both a cloud service or as a local deployment, are affected:
- Lumada AP
CISA ICS
Siemens Products affected by OpenSSL 3.0
cisa_ics·2022-12-15
Siemens Products affected by OpenSSL 3.0
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens Products affected by OpenSSL 3.0
Last RevisedDecember 15, 2022
Alert CodeICSA-22-349-09
## As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.5
- ATTENTION: Exploitable remotely/low attack complexity/public exploits available
- Vendor: Siemens
- Equipment: Calibre ICE, Mce
Microsoft
OpenSSL: CVE-2022-3602 X.509 certificate verification buffer overrun
vendor_msrc·2022-11-08·CVSS 7.5
CVE-2022-3602 [HIGH] OpenSSL: CVE-2022-3602 X.509 certificate verification buffer overrun
OpenSSL: CVE-2022-3602 X.509 certificate verification buffer overrun
FAQ: Why is this OpenSSL Software Foundation CVE included in the Security Update Guide?
The vulnerability assigned to this CVE is in OpenSSL Software which is consumed by the Microsoft products listed in the Security Updates table and are known to be affected. It is being documented in the Security Update Guide to announce that the latest builds of these products are no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.
FAQ: Where can I find further guidance for this OpenSSL vulnerability?
For more information and guidance see Awareness and guidance related to OpenSSL 3.0 - 3.0.6 risk (CVE-2022-3786 and CVE-2202-3602).
Open Source Software: Open Source
Ubuntu
OpenSSL vulnerabilities
vendor_ubuntu·2022-11-01·CVSS 7.5
CVE-2022-3358 [HIGH] OpenSSL vulnerabilities
Title: OpenSSL vulnerabilities
Summary: Several security issues were fixed in OpenSSL.
It was discovered that OpenSSL incorrectly handled certain X.509 Email
Addresses. If a certificate authority were tricked into signing a
specially-crafted certificate, a remote attacker could possibly use this
issue to cause OpenSSL to crash, resulting in a denial of service. The
default compiler options for affected releases reduce the vulnerability to
a denial of service. (CVE-2022-3602, CVE-2022-3786)
It was discovered that OpenSSL incorrectly handled applications creating
custom ciphers via the legacy EVP_CIPHER_meth_new() function. This issue
could cause certain applications that mishandled values to the function to
possibly end up with a NULL cipher and messages in plaintext.
(CVE-2022-3358)
In
Red Hat
OpenSSL: X.509 Email Address Buffer Overflow
vendor_redhat·2022-11-01·CVSS 7.5
CVE-2022-3602 [HIGH] CWE-119 OpenSSL: X.509 Email Address Buffer Overflow
OpenSSL: X.509 Email Address Buffer Overflow
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout f
Palo Alto
PAN-SA-2022-0006 Impact of OpenSSL 3.0 Vulnerabilities CVE-2022-3786 and CVE-2022-3602
vendor_paloalto·2022-10-31·CVSS 7.5
CVE-2022-3602 [HIGH] PAN-SA-2022-0006 Impact of OpenSSL 3.0 Vulnerabilities CVE-2022-3786 and CVE-2022-3602
PAN-SA-2022-0006 Impact of OpenSSL 3.0 Vulnerabilities CVE-2022-3786 and CVE-2022-3602
The OpenSSL Project has published two high
CVEs: CVE-2022-3602, CVE-2022-3786
Affected products: Cortex Data, Cortex XDR, Cortex XSOAR, Cortex Xpanse, GlobalProtect, PAN-OS, Prisma Access, Prisma Cloud, Prisma SD
Palo Alto
PAN-SA-2022-0006 Impact of OpenSSL 3.0 Vulnerabilities CVE-2022-3786 and CVE-2022-3602
vendor_paloalto·2022-10-31·CVSS 7.5
CVE-2022-3786 [HIGH] PAN-SA-2022-0006 Impact of OpenSSL 3.0 Vulnerabilities CVE-2022-3786 and CVE-2022-3602
PAN-SA-2022-0006 Impact of OpenSSL 3.0 Vulnerabilities CVE-2022-3786 and CVE-2022-3602
The OpenSSL Project has published two high
CVEs: CVE-2022-3602, CVE-2022-3786
Affected products: Cortex Data, Cortex XDR, Cortex XSOAR, Cortex Xpanse, GlobalProtect, PAN-OS, Prisma Access, Prisma Cloud, Prisma SD
Cisco
Vulnerabilities in OpenSSL Affecting Cisco Products: November 2022
vendor_cisco·2022-10-28·CVSS 7.5
CVE-2022-3602 [HIGH] Vulnerabilities in OpenSSL Affecting Cisco Products: November 2022
Vulnerabilities in OpenSSL Affecting Cisco Products: November 2022
On November 1, 2022, the OpenSSL Project announced the following vulnerabilities:
CVE-2022-3602 - X.509 Email Address 4-byte Buffer Overflow
CVE-2022-3786 - X.509 Email Address Variable Length Buffer Overflow
For a description of these vulnerabilities, see OpenSSL Security Advisory [Nov 1 2022].
This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-W9sdCc2a
Debian
CVE-2022-3602: openssl - A buffer overrun can be triggered in X.509 certificate verification, specificall...
vendor_debian·2022·CVSS 7.5
CVE-2022-3602 [HIGH] CVE-2022-3602: openssl - A buffer overrun can be triggered in X.509 certificate verification, specificall...
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announceme
Cisco
Vulnerabilities in OpenSSL Affecting Cisco Products: November 2022
vendor_cisco·CVSS 3.1
CVE-2022-3786 Vulnerabilities in OpenSSL Affecting Cisco Products: November 2022
CVE-2022-3786: Vulnerabilities in OpenSSL Affecting Cisco Products: November 2022
On November 1, 2022, the OpenSSL Project announced the following vulnerabilities: CVE-2022-3602 - X.509 Email Address 4-byte Buffer Overflow CVE-2022-3786 - X.509 Email Address Variable Length Buffer Overflow For a description of these vulnerabilities, see OpenSSL Security Advisory [Nov 1 2022] . This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-W9sdCc2a
CVSS: 3.1
Bug IDs: CSCwd44110, CSCwd44112
Cisco
Vulnerabilities in OpenSSL Affecting Cisco Products: November 2022
vendor_cisco·CVSS 3.1
CVE-2022-3602 Vulnerabilities in OpenSSL Affecting Cisco Products: November 2022
CVE-2022-3602: Vulnerabilities in OpenSSL Affecting Cisco Products: November 2022
On November 1, 2022, the OpenSSL Project announced the following vulnerabilities: CVE-2022-3602 - X.509 Email Address 4-byte Buffer Overflow CVE-2022-3786 - X.509 Email Address Variable Length Buffer Overflow For a description of these vulnerabilities, see OpenSSL Security Advisory [Nov 1 2022] . This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-W9sdCc2a
CVSS: 3.1
Bug IDs: CSCwd44110, CSCwd44112
OSV
X.509 Email Address 4-byte Buffer Overflow
osv·2022-11-01·CVSS 7.5
CVE-2022-3602 [HIGH] X.509 Email Address 4-byte Buffer Overflow
X.509 Email Address 4-byte Buffer Overflow
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs
after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to
continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address
to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or
potentially remote code execution.
Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout fo
GHSA
X.509 Email Address 4-byte Buffer Overflow
ghsa·2022-11-01·CVSS 7.5
CVE-2022-3602 [HIGH] CWE-120 X.509 Email Address 4-byte Buffer Overflow
X.509 Email Address 4-byte Buffer Overflow
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs
after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to
continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address
to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or
potentially remote code execution.
Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout fo
OSV
CVE-2022-3602: A buffer overrun can be triggered in X
osv·2022-11-01·CVSS 7.5
CVE-2022-3602 [HIGH] CVE-2022-3602: A buffer overrun can be triggered in X
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announceme
OSV
X.509 Email Address 4-byte Buffer Overflow
osv·2022-11-01·CVSS 7.5
CVE-2022-3602 [HIGH] X.509 Email Address 4-byte Buffer Overflow
X.509 Email Address 4-byte Buffer Overflow
A buffer overrun can be triggered in X.509 certificate verification,
specifically in name constraint checking. Note that this occurs
after certificate chain signature verification and requires either a
CA to have signed the malicious certificate or for the application to
continue certificate verification despite failure to construct a path
to a trusted issuer. An attacker can craft a malicious email address
to overflow four attacker-controlled bytes on the stack. This buffer
overflow could result in a crash (causing a denial of service) or
potentially remote code execution.
Many platforms implement stack overflow protections which would mitigate
against the risk of remote code execution. The risk may be further
mitigated based on stack layout fo
OSV
openssl vulnerabilities
osv·2022-11-01·CVSS 7.5
CVE-2022-3602 [HIGH] openssl vulnerabilities
openssl vulnerabilities
It was discovered that OpenSSL incorrectly handled certain X.509 Email
Addresses. If a certificate authority were tricked into signing a
specially-crafted certificate, a remote attacker could possibly use this
issue to cause OpenSSL to crash, resulting in a denial of service. The
default compiler options for affected releases reduce the vulnerability to
a denial of service. (CVE-2022-3602, CVE-2022-3786)
It was discovered that OpenSSL incorrectly handled applications creating
custom ciphers via the legacy EVP_CIPHER_meth_new() function. This issue
could cause certain applications that mishandled values to the function to
possibly end up with a NULL cipher and messages in plaintext.
(CVE-2022-3358)
Suricata
ET EXPLOIT Possible OpenSSL Punycode Email Address Buffer Overflow Attempt Outbound (CVE-2022-3602)
suricata·2022-11-02·CVSS 7.5
CVE-2022-3602 [HIGH] ET EXPLOIT Possible OpenSSL Punycode Email Address Buffer Overflow Attempt Outbound (CVE-2022-3602)
ET EXPLOIT Possible OpenSSL Punycode Email Address Buffer Overflow Attempt Outbound (CVE-2022-3602)
Rule: alert tls $HOME_NET any -> any any (msg:"ET EXPLOIT Possible OpenSSL Punycode Email Address Buffer Overflow Attempt Outbound (CVE-2022-3602)"; flow:established,to_server; content:"|06 03 55 1d 1e|"; content:"xn--"; fast_pattern; within:30; byte_test:2,>,513,-6,relative; reference:url,www.openssl.org/news/secadv/20221101.txt; reference:cve,2022-3602; classtype:attempted-admin; sid:2039619; rev:1; metadata:attack_target Server, created_at 2022_11_02, cve CVE_2022_3602, deployment Perimeter, performance_impact Significant, confidence Low, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_11_02;)
Suricata
ET EXPLOIT Possible OpenSSL Punycode Email Address Buffer Overflow Attempt Inbound (CVE-2022-3602)
suricata·2022-11-01·CVSS 7.5
CVE-2022-3602 [HIGH] ET EXPLOIT Possible OpenSSL Punycode Email Address Buffer Overflow Attempt Inbound (CVE-2022-3602)
ET EXPLOIT Possible OpenSSL Punycode Email Address Buffer Overflow Attempt Inbound (CVE-2022-3602)
Rule: alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible OpenSSL Punycode Email Address Buffer Overflow Attempt Inbound (CVE-2022-3602)"; flow:established,to_client; tls.certs; content:"|06 03 55 1d 1e|"; content:"xn--"; fast_pattern; within:30; byte_test:2,>,513,-6,relative; reference:url,www.openssl.org/news/secadv/20221101.txt; reference:cve,2022-3602; classtype:attempted-admin; sid:2039618; rev:1; metadata:attack_target Server, created_at 2022_11_01, cve CVE_2022_3602, deployment Perimeter, performance_impact Significant, confidence Low, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_11_02;)
No public exploits indexed.
Tenable
Mind the Gap: A Closer Look at the Vulnerabilities Disclosed in 2022
blogs_tenable·2023-05-09
Mind the Gap: A Closer Look at the Vulnerabilities Disclosed in 2022
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
November 2022 Patch Tuesday | Microsoft Releases 65 New Vulnerabilities With 10 Critical; Adobe Releases Zero Advisories (for the First Time in Six Years).
blogs_qualys·2022-11-08·CVSS 7.5
[HIGH] November 2022 Patch Tuesday | Microsoft Releases 65 New Vulnerabilities With 10 Critical; Adobe Releases Zero Advisories (for the First Time in Six Years).
## Table of Contents
Microsoft Patch Tuesday Summary
The November 2022 Microsoft Vulnerabilities are Classified as Follows:
OpenSSL 3.x Critical Vulnerability Highlights
OpenSSL 3.x Related Blogs and Resources
Microsoft Addressed Six Zero-Day Vulnerabilities
Microsoft Patch Tuesday Critical Vulnerability Highlights
Microsoft Release Summary
Adobe Security Bulletins and Advisories
About Qualys Patch Tuesday
Qualys Threat Research Blog Posts
Qualys Threat Protection High-Rated Advisories
Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response(VMDR)
Rapid Response with Patch Management (PM)
Extend the Power of VMDR to Enterprise Mobile Devices With Qualys VMDR Mobile
Execute Mitigation UsingCustom Assessment and Remediation(CAR)
Patch Tuesday Is
Tenable
Microsoft’s November 2022 Patch Tuesday Addresses 62 CVEs (CVE-2022-41073)
blogs_tenable·2022-11-08·CVSS 7.8
[HIGH] Microsoft’s November 2022 Patch Tuesday Addresses 62 CVEs (CVE-2022-41073)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
November 2022 Patch Tuesday | Microsoft Releases 65 New Vulnerabilities With 10 Critical; Adobe Releases Zero Advisories (for the First Time in Six Years). | Qualys
blogs_qualys·2022-11-08·CVSS 7.5
[HIGH] November 2022 Patch Tuesday | Microsoft Releases 65 New Vulnerabilities With 10 Critical; Adobe Releases Zero Advisories (for the First Time in Six Years). | Qualys
#### Table of Contents
- Microsoft Patch Tuesday Summary
- The November 2022 Microsoft Vulnerabilities are Classified as Follows:
- OpenSSL 3.x Critical Vulnerability Highlights
- OpenSSL 3.x Related Blogs and Resources
- Microsoft Addressed Six Zero-Day Vulnerabilities
- Microsoft Patch Tuesday Critical Vulnerability Highlights
- Microsoft Release Summary
- Adobe Security Bulletins and Advisories
- About Qualys Patch Tuesday
- Qualys Threat Research Blog Posts
- Qualys Threat Protection High-Rated Advisories
- Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response(VMDR)
- Rapid Response with Patch Management (PM)
- Extend the Power of VMDR to Enterprise Mobile Devices With Qualys VMDR Mobile
- Execute Mitigation UsingCustom Assessment and Remediation(CAR)
Checkpoint
7th November– Threat Intelligence Report
blogs_checkpoint·2022-11-07
CVE-2022-3602 7th November– Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 7th November– Threat Intelligence Report
For the latest discoveries in cyber research for the week of 7th November, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Two European automotive companies were hit by ransomware – The German multinational group Continental was hit by LockBit ransomware gang and the breached data has been published on Lockbit’s leak site. Italian company Landi Renzo was breached by Hive.
Check Point Harmony Endpoint, Anti-Bot and Threat Emulation provide pro
Unit42
Threat Brief: CVE-2022-3786 and CVE-2022-3602: OpenSSL X.509 Buffer Overflows
blogs_unit42·2022-11-03·CVSS 7.5
CVE-2022-3786 [HIGH] Threat Brief: CVE-2022-3786 and CVE-2022-3602: OpenSSL X.509 Buffer Overflows
Threat Research Center
High Profile Threats
Vulnerabilities
## Threat Brief: CVE-2022-3786 and CVE-2022-3602: OpenSSL X.509 Buffer Overflows
Shawn Westfall
Published: November 2, 2022
High Profile Threats
Vulnerabilities
Buffer Overflow
CVE-2022-3602
CVE-2022-3786
Network security
OpenSSL
## Executive Summary
On November 1, 2022, OpenSSL released a security advisory describing two high severity vulnerabilities within the OpenSSL library ( CVE-2022-3786 and CVE-2022-3602 ). OpenSSL versions from 3.0.0 - 3.0.6 are vulnerable, with 3.0.7 containing the patch for both vulnerabilities. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.
In the days leading up to the security advisory, many were saying these vulnerabilities had the potential to be as bad as the Heartbleed
Qualys
OpenSSL Vulnerability Recap | Qualys
blogs_qualys·2022-11-03·CVSS 7.5
[HIGH] OpenSSL Vulnerability Recap | Qualys
#### Table of Contents
- Knowing more about the vulnerability allows us to dissect why it is not as industry-changing as Heartbleed was 8 years ago.
- Related Posts
Last week a CRITICAL vulnerability in OpenSSL was pre-announced to give organizations a head start in coming up with a playbook for how to address the highest severity OpenSSL vulnerability since Heartbleed in 2014. A lot of effort was put in by vendors and organizations alike to come up with a proper response, while eagerly awaiting the announcement on November 1. When the information was released, the vulnerability was downgraded in severity and split into two (2) CVEs (CVE-2022-37786 and CVE-2022-3602), decreasing the impact on products that leverage OpenSSL 3.x. These two (2) OpenSSL vulnerabilities have been addressed in
Qualys
OpenSSL Vulnerability Recap
blogs_qualys·2022-11-03·CVSS 7.5
[HIGH] OpenSSL Vulnerability Recap
## Table of Contents
Knowing more about the vulnerability allows us to dissect why it is not as industry-changing as Heartbleed was 8 years ago.
Related Posts
Last week a CRITICAL vulnerability in OpenSSL was pre-announced to give organizations a head start in coming up with a playbook for how to address the highest severity OpenSSL vulnerability since Heartbleed in 2014. A lot of effort was put in by vendors and organizations alike to come up with a proper response, while eagerly awaiting the announcement on November 1. When the information was released, the vulnerability was downgraded in severity and split into two (2) CVEs ( CVE-2022-37786 and CVE-2022-3602 ), decreasing the impact on products that leverage OpenSSL 3.x. These two (2) OpenSSL vulnerabilities have been addressed in Op
Talos
Threat Source newsletter (Nov. 3, 2022): Mastodon, evolution, and LiveJournal oh my!
blogs_talos·2022-11-03
Threat Source newsletter (Nov. 3, 2022): Mastodon, evolution, and LiveJournal oh my!
Welcome to this week’s edition of the Threat Source newsletter.
I’m fascinated by how things live and die on the internet. Things that are ubiquitous to our daily lives are simply gone the next. LiveJournal and Myspace we hardly knew you. Elon Musk’s purchase of Twitter and the subsequent exodus led me down the nostalgic path of thinking about how times change and platforms change but things largely remain the same. Until now. We’ve grown as an entire internet community and we remember the pain of moving from app to app and site to site. Many top infosec follows have deactivated their accounts while others are weighing when and if they will leave. Several have moved to decentralized solutions like mastodon.social which saw an uptick of more than 70,000 new users in a single day after the
Unit42
Threat Brief: CVE-2022-3786 and CVE-2022-3602: OpenSSL X.509 Buffer Overflows
blogs_unit42·2022-11-03·CVSS 7.5
CVE-2022-3786 [HIGH] Threat Brief: CVE-2022-3786 and CVE-2022-3602: OpenSSL X.509 Buffer Overflows
## Executive Summary
On November 1, 2022, OpenSSL released a security advisory describing two high severity vulnerabilities within the OpenSSL library (CVE-2022-3786 and CVE-2022-3602). OpenSSL versions from 3.0.0 - 3.0.6 are vulnerable, with 3.0.7 containing the patch for both vulnerabilities. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.
In the days leading up to the security advisory, many were saying these vulnerabilities had the potential to be as bad as the Heartbleed vulnerability, and even OpenSSL originally stated that CVE-2022-3602 was going to be rated critical. Several factors seem to indicate that these vulnerabilities will not be easy to exploit and pose much less risk than originally thought:
- Both vulnerabilities require a malicious X.509 certificate that has
Talos
Threat Source newsletter (Nov. 3, 2022): Mastodon, evolution, and LiveJournal oh my!
blogs_talos·2022-11-03
Threat Source newsletter (Nov. 3, 2022): Mastodon, evolution, and LiveJournal oh my!
## Threat Source newsletter (Nov. 3, 2022): Mastodon, evolution, and LiveJournal oh my!
Welcome to this week’s edition of the Threat Source newsletter.
I’m fascinated by how things live and die on the internet. Things that are ubiquitous to our daily lives are simply gone the next. LiveJournal and Myspace we hardly knew you. Elon Musk’s purchase of Twitter and the subsequent exodus led me down the nostalgic path of thinking about how times change and platforms change but things largely remain the same. Until now. We’ve grown as an entire internet community and we remember the pain of moving from app to app and site to site. Many top infosec follows have deactivated their accounts while others are weighing when and if they will leave. Several have moved to decentralized solutions like mas
Sentinelone
Everything You Need To Know About OpenSSL Vulnerabilities
blogs_sentinelone·2022-11-02·CVSS 7.5
CVE-2022-3786 [HIGH] Everything You Need To Know About OpenSSL Vulnerabilities
OpenSSL Project released OpenSSL version 3.0.7 on November 1st, 2022 to address specific vulnerabilities (CVE-2022-3786 and CVE-2022-3602) that had been largely unknown until today.
The new version will fix these High severity vulnerabilities in the library affecting OpenSSL versions 3.0.0 and above, as well as any application with an embedded, impacted OpenSSL library.
An important thing to note is that this is only the second time since 2014 that OpenSSL has categorized an issue/vulnerability as Critical, but then it was changed to High.
Let’s dive into the details and understand how it impacts us.
## What is OpenSSL?
OpenSSL is a cryptographic library that offers an open-source application of the TLS protocol used for encrypting communications on the Internet. First released in 199
Sentinelone
Everything You Need To Know About OpenSSL Vulnerabilities
blogs_sentinelone·2022-11-02·CVSS 7.5
CVE-2022-3786 [HIGH] Everything You Need To Know About OpenSSL Vulnerabilities
OpenSSL Project released OpenSSL version 3.0.7 on November 1st, 2022 to address specific vulnerabilities (CVE-2022-3786 and CVE-2022-3602) that had been largely unknown until today.
The new version will fix these High severity vulnerabilities in the library affecting OpenSSL versions 3.0.0 and above, as well as any application with an embedded, impacted OpenSSL library.
An important thing to note is that this is only the second time since 2014 that OpenSSL has categorized an issue/vulnerability as Critical, but then it was changed to High.
Let’s dive into the details and understand how it impacts us.
## What is OpenSSL?
OpenSSL is a cryptographic library that offers an open-source application of the TLS protocol used for encrypting communications on the Internet. First released in 199
Tenable
CVE-2022-3786 and CVE-2022-3602: OpenSSL Patches Two High Severity Vulnerabilities
blogs_tenable·2022-11-01·CVSS 7.5
[HIGH] CVE-2022-3786 and CVE-2022-3602: OpenSSL Patches Two High Severity Vulnerabilities
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
Threat Advisory: High Severity OpenSSL Vulnerabilities
blogs_talos·2022-11-01·CVSS 7.5
CVE-2022-3602 [HIGH] Threat Advisory: High Severity OpenSSL Vulnerabilities
In late October two new buffer overflow vulnerabilities, CVE-2022-3602 and CVE-2022-3786, were announced in OpenSSL versions 3.0.0 to 3.0.6. These vulnerabilities can be exploited by sending an X.509 certificate with a specially crafted email address, potentially causing a buffer overflow resulting in a crash or remote code execution (RCE). X.509 is the standard defining the format of public key certificates, commonly used in protocols including TLS as well as digital signatures. Importantly, these vulnerabilities can affect both the client and server in contrast to most vulnerabilities that typically impact one or the other, broadening the potential attack surface.
These vulnerabilities could be very impactful as OpenSSL is widely used, and the affected version is included in some major
Zscaler
Security Advisory for OpenSSL Vulnerabilities | Zscaler Blog
blogs_zscaler·2022-11-01·CVSS 7.5
[HIGH] Security Advisory for OpenSSL Vulnerabilities | Zscaler Blog
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Talos
Threat Advisory: High Severity OpenSSL Vulnerabilities
blogs_talos·2022-11-01·CVSS 7.5
CVE-2022-3602 [HIGH] Threat Advisory: High Severity OpenSSL Vulnerabilities
## Threat Advisory: High Severity OpenSSL Vulnerabilities
In late October two new buffer overflow vulnerabilities, CVE-2022-3602 and CVE-2022-3786 , were announced in OpenSSL versions 3.0.0 to 3.0.6. These vulnerabilities can be exploited by sending an X.509 certificate with a specially crafted email address, potentially causing a buffer overflow resulting in a crash or remote code execution (RCE). X.509 is the standard defining the format of public key certificates, commonly used in protocols including TLS as well as digital signatures. Importantly, these vulnerabilities can affect both the client and server in contrast to most vulnerabilities that typically impact one or the other, broadening the potential attack surface.
These vulnerabilities could be very impactful as OpenSSL is wide
Tenable
What You Should Know about the New OpenSSL Vulnerability
blogs_tenable·2022-10-31
What You Should Know about the New OpenSSL Vulnerability
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Sentinelone
OpenSSL 3 Critical Vulnerability | What Do Organizations Need To Do Now?
blogs_sentinelone·2022-10-31·CVSS 7.5
CVE-2022-3786 [HIGH] OpenSSL 3 Critical Vulnerability | What Do Organizations Need To Do Now?
Last week, the OpenSSL project team announced the release of OpenSSL version 3.0.7, which was made available on Tuesday, November 1st. The update is a security fix for two vulnerabilities in OpenSSL 3.0.x, and developers and organizations are being urged to ensure that they patch any instances of OpenSSL 3 in their software stack as a matter of urgency. The vulnerabilities, CVE-2022-3786 and CVE-2022-3602, affect version 3.0.x and do not impact OpenSSL 1.1.1 or LibreSSL.
SentinelOne customers have instant visibility of OpenSSL versions within their organizations. As such, Singularity XDR is a useful visibility solution in ensuring your organization is ready for the OpenSSL 3 update.
## What is OpenSSL?
OpenSSL is an open-source cryptography library widely used by applications, operating
Sentinelone
OpenSSL 3 Critical Vulnerability | What Do Organizations Need To Do Now?
blogs_sentinelone·2022-10-31·CVSS 7.5
CVE-2022-3786 [HIGH] OpenSSL 3 Critical Vulnerability | What Do Organizations Need To Do Now?
Last week, the OpenSSL project team announced the release of OpenSSL version 3.0.7, which was made available on Tuesday, November 1st. The update is a security fix for two vulnerabilities in OpenSSL 3.0.x , and developers and organizations are being urged to ensure that they patch any instances of OpenSSL 3 in their software stack as a matter of urgency. The vulnerabilities, CVE-2022-3786 and CVE-2022-3602, affect version 3.0.x and do not impact OpenSSL 1.1.1 or LibreSSL.
SentinelOne customers have instant visibility of OpenSSL versions within their organizations. As such, Singularity XDR is a useful visibility solution in ensuring your organization is ready for the OpenSSL 3 update.
## What is OpenSSL?
OpenSSL is an open-source cryptography library widely used by applications, operatin
Qualys
Qualys Research Alert: OpenSSL 3.0.7 – What You Need To Know
blogs_qualys·2022-10-31·CVSS 7.5
CVE-2022-3786 [HIGH] Qualys Research Alert: OpenSSL 3.0.7 – What You Need To Know
## Table of Contents
What is OpenSSL?
What is OpenSSL Vulnerability CVE-2022-3786 & CVE-2022-3602?
Vulnerable Versions
What Should Organizations Do?
How Can Qualys Help?
Discover Vulnerable Instances Using Qualys VMDR
Discover Vulnerable Container Images Using Qualys Container Security (CS)
Discover Vulnerable Instances Using Qualys Web Application Scanning (WAS)
Patch Vulnerable Systems Using Qualys Patch Management (PM)
Initiate Endpoint Response Actions Using Custom Assessment and Remediation (CAR)
We encourage our customers to leverage our Vulnerability Detection Pipelineto track new vulnerability detection development and status.
Frequently Asked Questions
On Tuesday, November 1, 2022, the OpenSSL project released version 3.0.7 of OpenSSL, an update that patches two buffe
Qualys
OpenSSL 3.0.7 Vulnerabilities | Qualys Research Alert | Qualys
blogs_qualys·2022-10-31·CVSS 7.5
CVE-2022-3786 [HIGH] OpenSSL 3.0.7 Vulnerabilities | Qualys Research Alert | Qualys
#### Table of Contents
- What is OpenSSL?
- What is OpenSSL Vulnerability CVE-2022-3786 & CVE-2022-3602?
- Vulnerable Versions
- What Should Organizations Do?
- How Can Qualys Help?
- Discover Vulnerable Instances Using Qualys VMDR
- Discover Vulnerable Container Images Using Qualys Container Security (CS)
- Discover Vulnerable Instances Using Qualys Web Application Scanning (WAS)
- Patch Vulnerable Systems Using Qualys Patch Management (PM)
- Initiate Endpoint Response Actions Using Custom Assessment and Remediation (CAR)
- We encourage our customers to leverage our Vulnerability Detection Pipelineto track new vulnerability detection development and status.
- Frequently Asked Questions
On Tuesday, November 1, 2022, the OpenSSL project released version 3.0.7 of OpenSSL, an update that pa
Wiz
OpenSSL vulnerabilities: Everything you need to know | Wiz Blog
blogs_wiz·2022-10-29·CVSS 7.5
CVE-2022-3602 [HIGH] OpenSSL vulnerabilities: Everything you need to know | Wiz Blog
TL;DR: OpenSSL Project released two new vulnerabilities, CVE-2022-3602 and CVE-2022-3786, which are less severe than previously announced. According to Wiz Research, these buffer overflow vulnerabilities are hard to exploit and require specific exploits per target application; the likelihood of generic, mass exploitation attempts of clients/servers that utilize the OpenSSL 3 library is low. Moreover, Wiz data shows only 1.5% of OpenSSL instances are impacted versions.
*This blog was updated on November 1st, 2022 following OpenSSL Project's patch release.
## What we know about the OpenSSL vulnerabilities so far
OpenSSL is a cryptographic library that is universally used for encrypting communications on the Internet. It is widely used by Internet servers, including the majority of HTTPS w
Wiz
OpenSSL vulnerabilities: Everything you need to know | Wiz Blog
blogs_wiz·2022-10-29·CVSS 7.5
CVE-2022-3602 [HIGH] OpenSSL vulnerabilities: Everything you need to know | Wiz Blog
TL;DR: OpenSSL Project released two new vulnerabilities, CVE-2022-3602 and CVE-2022-3786, which are less severe than previously announced. According to Wiz Research, these buffer overflow vulnerabilities are hard to exploit and require specific exploits per target application; the likelihood of generic, mass exploitation attempts of clients/servers that utilize the OpenSSL 3 library is low. Moreover, Wiz data shows only 1.5% of OpenSSL instances are impacted versions.
*This blog was updated on November 1st, 2022 following OpenSSL Project's patch release.
## What we know about the OpenSSL vulnerabilities so far
OpenSSL is a cryptographic library that is universally used for encrypting communications on the Internet. It is widely used by Internet servers , including the majority of HTTPS
Tenable
Tenable Network Security Podcast Episode 204 - "OpenSSL Again, Back to Basics"
blogs_tenable·2014-06-05
Tenable Network Security Podcast Episode 204 - "OpenSSL Again, Back to Basics"
Blog /
Subscribe
# Tenable Network Security Podcast Episode 204 - "OpenSSL Again, Back to Basics"
Paul Asadoorian
June 5, 2014
3 Min Read
### Announcements
- We're hiring! - Visit the Tenable website for more information about open positions.
- Tenable Named one of the Coolest Companies in Baltimore
- Want to ask questions about Nessus, SecurityCenter, LCE, and PVS and get answers from the experts at Tenable? Join Tenable's Discussion Forum for custom scripts, announcements, and more!
- You can find links to subscribe to Tenable's Podcast feed, YouTube Channel, Twitter and Facebook accounts at http://www.tenable.com/podcast!
1. Your devices Heartbleeding - again
2. 'Son Of Heartbleed' Hits Android And WiFi Networks
3. Compliance: The Surprising Gift Of Windows XP
4. Linux users at r
Tenable
Tenable Network Security Podcast Episode 204 - "OpenSSL Again, Back to Basics"
blogs_tenable·2014-06-05
Tenable Network Security Podcast Episode 204 - "OpenSSL Again, Back to Basics"
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
Tenable Network Security Podcast - Episode 200
blogs_tenable·2014-04-21
Tenable Network Security Podcast - Episode 200
Blog /
Subscribe
# Tenable Network Security Podcast - Episode 200
Paul Asadoorian
April 21, 2014
3 Min Read
### Announcements
- We're hiring! - Visit the Tenable website for more information about open positions.
- Want to ask questions about Nessus, SecurityCenter, LCE, and PVS and get answers from the experts at Tenable? Join Tenable's Discussion Forum for custom scripts, announcements, and more!
- You can find links to subscribe to Tenable's Podcast feed, YouTube Channel, Twitter and Facebook accounts at http://www.tenable.com/podcast!
### Discussion
- SCADA Device Vulnerability Detection - How do we do it? Scan, Sniff, Log, "Real-time" all these words come into play, but what do they really mean and how do they help you solve problems and reduce risk? How do we deal with XP in
Tenable
Tenable Network Security Podcast - Episode 200
blogs_tenable·2014-04-21
Tenable Network Security Podcast - Episode 200
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Greynoiseio
NoiseLetter March 2026
blogs_greynoiseio
NoiseLetter March 2026
Events, events… and yes, even more events. 🌍 GreyNoise has been on the move. March kept us busy with stops at eCrimes in London and SecIT in Hanover—but we’re just getting started. Over the next few months, we’ll be hitting the road for CrowdStrike CrowdTours across eight cities, heading to Glasgow to speak and sponsor CyberUK, and making our way to Tampa for H-ISAC. If you’ll be at any of these (or nearby), we’d love to connect.
And while we’ve been racking up miles, we haven’t slowed down on the research front. We’ve just released some exciting new findings—with even more coming in the next few weeks—so keep an eye out.
Thanks, as always, for being part of the GreyNoise community.
Featured
About this new report
Every enterprise firewall processes traffic from residential IP space. T
Zscaler
CISO Monthly Roundup, October 2022: ThreatLabz Data Loss Report; PHP Ducktail infostealer; LilithBot malware; vulnerabilities in OpenSSL, Microsoft, and Apache; Windows CLFS zero-day | CXO Revolutiona
blogs_zscaler
CISO Monthly Roundup, October 2022: ThreatLabz Data Loss Report; PHP Ducktail infostealer; LilithBot malware; vulnerabilities in OpenSSL, Microsoft, and Apache; Windows CLFS zero-day | CXO Revolutiona
## CISO Monthly Roundup, October 2022: ThreatLabz Data Loss Report; PHP Ducktail infostealer; LilithBot malware; vulnerabilities in OpenSSL, Microsoft, and Apache; Windows CLFS zero-day
Deepen Desai
Contributor
Zscaler
## Nov 2, 2022
The CISO Monthly Roundup (formerly the ThreatLabz monthly report) provides the latest threat research and relevant insights on cyber-related subjects from the ThreatLabz team and Deepen Desai, CISO at Zscaler.
The CISO Monthly Roundup (formerly the ThreatLabz monthly report) provides the latest threat research from Deepen Desai and the ThreatLabz team, along with insights on other cyber-related subjects. In October, ThreatLabz released their 2022 Data Loss Report, researched a PHP version of Ducktail infostealer, and analyzed LilithBot malware. My team a
Recorded Future
Top 5 Attack Surface Risks of 2022
blogs_recorded_future
Top 5 Attack Surface Risks of 2022
# Top 5 Attack Surface Risks of 2022
In a bid to contend with this year’s most prominent cyber threats, security teams everywhere have been forced to duly advance their understanding of what constitutes an attack surface.
A typical response from the community at large abides somewhere between the glaring redefinition of the traditional perimeter—that which incorporates the eroding, or blurring, of former demarcation lines—and the incidental yet insidious role of social engineering techniques ever threatening to run aground any significant defensive posture.
By contrast, cyber defense programs remain largely reactive and, frankly, quite disappointing at times. The idea of having an immersive, lessons-learned approach to security, whereby we generally assume to be faster in detecting atta
Greynoiseio
GreyNoise
blogs_greynoiseio·CVSS 7.5
[HIGH] GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Recorded Future
Top 5 Attack Surface Risks of 2022 | Recorded Future
blogs_recorded_future
Top 5 Attack Surface Risks of 2022 | Recorded Future
## Top 5 Attack Surface Risks of 2022
In a bid to contend with this year’s most prominent cyber threats, security teams everywhere have been forced to duly advance their understanding of what constitutes an attack surface .
A typical response from the community at large abides somewhere between the glaring redefinition of the traditional perimeter—that which incorporates the eroding, or blurring, of former demarcation lines—and the incidental yet insidious role of social engineering techniques ever threatening to run aground any significant defensive posture.
By contrast, cyber defense programs remain largely reactive and, frankly, quite disappointing at times. The idea of having an immersive, lessons-learned approach to security, whereby we generally assume to be faster in detecting at
Zscaler
CISO Monthly Roundup, November 2022: World Cup-related threats, renewed attacks on the Indian government, holiday shopping scams, and malware in the Google Play Store | CXO Revolutionaries
blogs_zscaler
CISO Monthly Roundup, November 2022: World Cup-related threats, renewed attacks on the Indian government, holiday shopping scams, and malware in the Google Play Store | CXO Revolutionaries
## CISO Monthly Roundup, November 2022: World Cup-related threats, renewed attacks on the Indian government, holiday shopping scams, and malware in the Google Play Store
Deepen Desai
Contributor
Zscaler
## Dec 2, 2022
The November CISO Monthly Roundup explores World Cup-related threats, attacks targeting the Indian government, holiday season scams, and more.
The CISO Monthly Roundup provides the latest threat research from Deepen Desai and the ThreatLabz team, along with insights on other cyber-related subjects. In November, ThreatLabz uncovered several World Cup-related threats, new attacks on the Indian government, holiday skimming scams, and malware in the Google Play Store.
## Surge of fake FIFA World Cup streaming sites
ThreatLabz is always watching for spikes in malicious act
arXiv
Tweezers: A Framework for Security Event Detection via Event Attribution-centric Tweet Embedding
arxiv_fulltext·2024-09-12
Tweezers: A Framework for Security Event Detection via Event Attribution-centric Tweet Embedding
: A Framework for Security Event Detection via Event Attribution-centric Tweet Embedding
Jian Cui1 ,
Hanna Kim2,
Eugene Jang3,
Dayeon Yim3,
Kicheol Kim3,
Yongjae Lee3,
Jin-Woo Chung3,
Seungwon Shin2,
Xiaojing Liao1
1Indiana University Bloomington, 2KAIST, 3S2W Inc.
1\cuijian, xliao\@iu.edu, 2\gkssk3654, claude\@kaist.ac.kr, 3\genesith, dayeon, kkim, lee, jwchung\@s2w.inc
\@IEEEpubidpullup6.5
Network and Distributed System Security (NDSS) Symposium 2025
23–28 February 2025, San Diego, CA, USA
ISBN 979-8-9894372-8-3
https://dx.doi.org/10.14722/ndss.2025.23139
www.ndss-symposium.org
[ ]
Work performed while at S2W Inc.
## Abstract
Twitter is recognized as a crucial platform for the dissemination and gathering of Cyber Threat Intelligence (CTI). Its capability to provide real-tim
Bugzilla
CVE-2022-3602 OpenSSL: X.509 Email Address Buffer Overflow
bugzilla·2022-10-26·CVSS 7.5
CVE-2022-3602 [HIGH] CVE-2022-3602 OpenSSL: X.509 Email Address Buffer Overflow
CVE-2022-3602 OpenSSL: X.509 Email Address Buffer Overflow
As per upstream report:
A buffer overrun can be triggered by sending an X.509 certificate with a specially crafted email address field to a vulnerable client or server. This can result in an overflow of four attacker-controlled bytes on the stack. This could result in a crash (causing a denial of service) or possibly result in remote code execution.
The most common situation where this can be triggered is when a server requests client authentication after a malicious client connects. The converse of a client connecting to a malicious server is also believed to be vulnerable in the same manner.
OpenSSL versions 3.0.0 to 3.0.6 are vulnerable to this attack.
OpenSSL 3.0 users should upgrade to OpenSSL 3.0.7.
OpenSSL 1.1.1 and 1.
http://packetstormsecurity.com/files/169687/OpenSSL-Security-Advisory-20221101.htmlhttp://www.openwall.com/lists/oss-security/2022/11/01/15http://www.openwall.com/lists/oss-security/2022/11/01/16http://www.openwall.com/lists/oss-security/2022/11/01/17http://www.openwall.com/lists/oss-security/2022/11/01/18http://www.openwall.com/lists/oss-security/2022/11/01/19http://www.openwall.com/lists/oss-security/2022/11/01/20http://www.openwall.com/lists/oss-security/2022/11/01/21http://www.openwall.com/lists/oss-security/2022/11/01/24http://www.openwall.com/lists/oss-security/2022/11/02/1http://www.openwall.com/lists/oss-security/2022/11/02/10http://www.openwall.com/lists/oss-security/2022/11/02/11http://www.openwall.com/lists/oss-security/2022/11/02/12http://www.openwall.com/lists/oss-security/2022/11/02/13http://www.openwall.com/lists/oss-security/2022/11/02/14http://www.openwall.com/lists/oss-security/2022/11/02/15http://www.openwall.com/lists/oss-security/2022/11/02/2http://www.openwall.com/lists/oss-security/2022/11/02/3http://www.openwall.com/lists/oss-security/2022/11/02/5http://www.openwall.com/lists/oss-security/2022/11/02/6http://www.openwall.com/lists/oss-security/2022/11/02/7http://www.openwall.com/lists/oss-security/2022/11/02/9http://www.openwall.com/lists/oss-security/2022/11/03/1http://www.openwall.com/lists/oss-security/2022/11/03/10http://www.openwall.com/lists/oss-security/2022/11/03/11http://www.openwall.com/lists/oss-security/2022/11/03/2http://www.openwall.com/lists/oss-security/2022/11/03/3http://www.openwall.com/lists/oss-security/2022/11/03/5http://www.openwall.com/lists/oss-security/2022/11/03/6http://www.openwall.com/lists/oss-security/2022/11/03/7http://www.openwall.com/lists/oss-security/2022/11/03/9https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fe3b639dc19b325846f4f6801f2f4604f56e3de3https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63YRPWPUSX3MBHNPIEJZDKQT6YA7UF6S/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DWP23EZYOBDJQP7HP4YU7W2ABU2YDITS/https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0023https://security.gentoo.org/glsa/202211-01https://security.netapp.com/advisory/ntap-20221102-0001/https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-W9sdCc2ahttps://www.kb.cert.org/vuls/id/794340https://www.openssl.org/news/secadv/20221101.txthttp://packetstormsecurity.com/files/169687/OpenSSL-Security-Advisory-20221101.htmlhttp://www.openwall.com/lists/oss-security/2022/11/01/15http://www.openwall.com/lists/oss-security/2022/11/01/16http://www.openwall.com/lists/oss-security/2022/11/01/17http://www.openwall.com/lists/oss-security/2022/11/01/18http://www.openwall.com/lists/oss-security/2022/11/01/19http://www.openwall.com/lists/oss-security/2022/11/01/20http://www.openwall.com/lists/oss-security/2022/11/01/21http://www.openwall.com/lists/oss-security/2022/11/01/24http://www.openwall.com/lists/oss-security/2022/11/02/1http://www.openwall.com/lists/oss-security/2022/11/02/10http://www.openwall.com/lists/oss-security/2022/11/02/11http://www.openwall.com/lists/oss-security/2022/11/02/12http://www.openwall.com/lists/oss-security/2022/11/02/13http://www.openwall.com/lists/oss-security/2022/11/02/14http://www.openwall.com/lists/oss-security/2022/11/02/15http://www.openwall.com/lists/oss-security/2022/11/02/2http://www.openwall.com/lists/oss-security/2022/11/02/3http://www.openwall.com/lists/oss-security/2022/11/02/5http://www.openwall.com/lists/oss-security/2022/11/02/6http://www.openwall.com/lists/oss-security/2022/11/02/7http://www.openwall.com/lists/oss-security/2022/11/02/9http://www.openwall.com/lists/oss-security/2022/11/03/1http://www.openwall.com/lists/oss-security/2022/11/03/10http://www.openwall.com/lists/oss-security/2022/11/03/11http://www.openwall.com/lists/oss-security/2022/11/03/2http://www.openwall.com/lists/oss-security/2022/11/03/3http://www.openwall.com/lists/oss-security/2022/11/03/5http://www.openwall.com/lists/oss-security/2022/11/03/6http://www.openwall.com/lists/oss-security/2022/11/03/7http://www.openwall.com/lists/oss-security/2022/11/03/9https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fe3b639dc19b325846f4f6801f2f4604f56e3de3https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63YRPWPUSX3MBHNPIEJZDKQT6YA7UF6S/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DWP23EZYOBDJQP7HP4YU7W2ABU2YDITS/https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0023https://security.gentoo.org/glsa/202211-01https://security.netapp.com/advisory/ntap-20221102-0001/https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-W9sdCc2ahttps://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00789.htmlhttps://www.kb.cert.org/vuls/id/794340https://www.openssl.org/news/secadv/20221101.txthttps://cert-portal.siemens.com/productcert/html/ssa-408105.html
2022-11-01
Published