CVE-2022-3786
published 2022-11-01CVE-2022-3786: A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain…
PriorityP264high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
91.15%
99.8th percentile
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openssl | < openssl 3.0.7-1 (bookworm) | openssl 3.0.7-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | azure_sdk_for_c | — | — |
| msrc | microsoft_azure_kubernetes_service | — | — |
| msrc | vcpkg | — | — |
| nodejs | node.js | — | — |
| nodejs | node.js | — | — |
| nodejs | node.js | >= 18.0.0 < 18.11.0 | 18.11.0 |
| openssl | openssl | >= 0 < 3.0.7-1 | 3.0.7-1 |
| openssl | openssl | >= 0 < 3.0.7-1 | 3.0.7-1 |
| openssl | openssl | >= 0 < 3.0.7-1 | 3.0.7-1 |
| openssl | openssl | >= 0 < 3.0.2-0ubuntu1.7 | 3.0.2-0ubuntu1.7 |
| openssl | openssl | >= 3.0.0 < 3.0.7 | 3.0.7 |
| paloalto | cortex_data | — | — |
| paloalto | cortex_xdr | — | — |
| paloalto | cortex_xpanse | — | — |
| paloalto | cortex_xsoar | — | — |
| paloalto | globalprotect | — | — |
| paloalto | pan-os | — | — |
| paloalto | prisma_access | — | — |
| paloalto | prisma_cloud | — | — |
| paloalto | prisma_sd | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2022-3786 is exploitable via a malicious X.509 certificate containing a crafted email address in the Subject Alternative Name (SAN) name constraint field; the overflow is triggered during certificate chain verification in the punycode decoder component of libcrypto. Look for TLS handshakes presenting certificates with anomalously long or malformed email-type SAN entries. ↗
- →The vulnerability is located in the punycode decoder component of the OpenSSL libcrypto library, within the X.509 name constraint checking code path. Crash/DoS of a TLS service (unexpected process termination of an OpenSSL 3.0.x process) following a TLS handshake is a strong indicator of exploitation. ↗
- →For TLS servers, exploitation requires the server to be configured for mutual TLS (mTLS / client authentication). Monitor for unexpected crashes of mTLS-enabled services running OpenSSL 3.0.0–3.0.6 after receiving a client certificate. ↗
- →At least one public proof-of-concept (PoC) exploit exists that crashes the vulnerable system (DoS). Monitor threat intel feeds for more capable PoCs enabling RCE. ↗
- →Exploitation occurs after certificate chain signature verification, meaning the attacker must either control a CA-signed certificate or exploit an application that continues verification despite path-building failure. Prioritize internet-facing TLS endpoints running OpenSSL 3.0.0–3.0.6. ↗
- ·CVE-2022-3786 only affects OpenSSL versions 3.0.0 through 3.0.6; OpenSSL 1.x is NOT affected. The vast majority of deployed OpenSSL instances (98.5% per Wiz data) are unaffected older versions. ↗
- ·TLS server exploitation requires the server to be explicitly configured to request client authentication (mTLS). Standard TLS servers that do not request client certificates are not directly exploitable via the server-side attack vector. ↗
- ·Many platforms implement stack overflow protections (e.g., stack canaries, ASLR) which mitigate the risk of RCE; CVE-2022-3786 is primarily a DoS (crash) risk due to the overflow being constrained to '.' (0x2E) bytes only. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_cisco7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
ICONICS and Mitsubishi Electric Products
cisa_ics·2023-08-17·CVSS 7.5
[HIGH] ICONICS and Mitsubishi Electric Products
ICS Advisory
##
ICONICS and Mitsubishi Electric Products
Release DateAugust 17, 2023
Alert CodeICSA-23-229-01
## 1. EXECUTIVE SUMMARY
- CVSS v3 5.9
- ATTENTION: Exploitable remotely
- Vendor: ICONICS, Mitsubishi Electric
- Equipment: ICONICS Product Suite
- Vulnerabilities: Buffer Overflow, Out-of-Bounds Read, Observable Timing Discrepancy, Double Free, and NULL Pointer Dereference
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could result in information disclosure, denial-of-service, or remote code execution.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
ICONICS reports these vulnerabilities affect the following products using OpenSSL:
-
ICONICS Suite including GENESIS64, Hyper Historian, AnalytiX, and MobileHMI:
CISA ICS
Hitachi Energy PCU400
cisa_ics·2023-01-19·CVSS 7.5
[HIGH] Hitachi Energy PCU400
ICS Advisory
##
Hitachi Energy PCU400
Last RevisedJanuary 19, 2023
Alert CodeICSA-23-019-01
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.5
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Hitachi Energy
- Equipment: PCU400
- Vulnerabilities: Reliance on Uncontrolled Component
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could result in a denial-of-service condition on both the logging function of the device and its associated server.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
The following versions of PCU400, a network manager and process communication unit, are affected:
- PCU400: Versions 9.3.0 and later up to but not including 9.3.8
- PCULogger tool: Version 1.0.1
## 3.2 VULNERABILITY OVERVIEW
3.2.1 RELIANCE
CISA ICS
Hitachi Energy Lumada Asset Performance Management
cisa_ics·2023-01-05·CVSS 7.5
[HIGH] Hitachi Energy Lumada Asset Performance Management
ICS Advisory
##
Hitachi Energy Lumada Asset Performance Management
Last RevisedJanuary 05, 2023
Alert CodeICSA-23-005-03
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Hitachi Energy
- Equipment: Lumada Asset Performance Management (APM)
- Vulnerabilities: Classic Buffer Overflow, Out-of-bounds Write
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could cause a denial-of-service condition or unauthorized remote arbitrary code execution.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
The following versions of Lumada Asset Performance Management (APM), a web-based asset monitoring software deployable as both a cloud service or as a local deployment, are affected:
- Lumada AP
CISA ICS
Siemens Products affected by OpenSSL 3.0
cisa_ics·2022-12-15
Siemens Products affected by OpenSSL 3.0
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens Products affected by OpenSSL 3.0
Last RevisedDecember 15, 2022
Alert CodeICSA-22-349-09
## As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.5
- ATTENTION: Exploitable remotely/low attack complexity/public exploits available
- Vendor: Siemens
- Equipment: Calibre ICE, Mce
Microsoft
OpenSSL: CVE-2022-3602 X.509 certificate verification buffer overrun
vendor_msrc·2022-11-08·CVSS 7.5
CVE-2022-3602 [HIGH] OpenSSL: CVE-2022-3602 X.509 certificate verification buffer overrun
OpenSSL: CVE-2022-3602 X.509 certificate verification buffer overrun
FAQ: Why is this OpenSSL Software Foundation CVE included in the Security Update Guide?
The vulnerability assigned to this CVE is in OpenSSL Software which is consumed by the Microsoft products listed in the Security Updates table and are known to be affected. It is being documented in the Security Update Guide to announce that the latest builds of these products are no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.
FAQ: Where can I find further guidance for this OpenSSL vulnerability?
For more information and guidance see Awareness and guidance related to OpenSSL 3.0 - 3.0.6 risk (CVE-2022-3786 and CVE-2202-3602).
Open Source Software: Open Source
Microsoft
OpenSSL: CVE-2022-3786 X.509 certificate verification buffer overrun
vendor_msrc·2022-11-08·CVSS 7.5
CVE-2022-3786 [HIGH] OpenSSL: CVE-2022-3786 X.509 certificate verification buffer overrun
OpenSSL: CVE-2022-3786 X.509 certificate verification buffer overrun
FAQ: Why is this OpenSSL Software Foundation CVE included in the Security Update Guide?
The vulnerability assigned to this CVE is in OpenSSL Software which is consumed by the Microsoft products listed in the Security Updates table and are known to be affected. It is being documented in the Security Update Guide to announce that the latest builds of these products are no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.
FAQ: Where can I find further guidance for this OpenSSL vulnerability?
For more information and guidance see Awareness and guidance related to OpenSSL 3.0 - 3.0.6 risk (CVE-2022-3786 and CVE-2202-3602).
Open Source Software: Open Source
Red Hat
OpenSSL: X.509 Email Address Variable Length Buffer Overflow
vendor_redhat·2022-11-01·CVSS 7.5
CVE-2022-3786 [HIGH] CWE-119 OpenSSL: X.509 Email Address Variable Length Buffer Overflow
OpenSSL: X.509 Email Address Variable Length Buffer Overflow
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests cl
Ubuntu
OpenSSL vulnerabilities
vendor_ubuntu·2022-11-01·CVSS 7.5
CVE-2022-3358 [HIGH] OpenSSL vulnerabilities
Title: OpenSSL vulnerabilities
Summary: Several security issues were fixed in OpenSSL.
It was discovered that OpenSSL incorrectly handled certain X.509 Email
Addresses. If a certificate authority were tricked into signing a
specially-crafted certificate, a remote attacker could possibly use this
issue to cause OpenSSL to crash, resulting in a denial of service. The
default compiler options for affected releases reduce the vulnerability to
a denial of service. (CVE-2022-3602, CVE-2022-3786)
It was discovered that OpenSSL incorrectly handled applications creating
custom ciphers via the legacy EVP_CIPHER_meth_new() function. This issue
could cause certain applications that mishandled values to the function to
possibly end up with a NULL cipher and messages in plaintext.
(CVE-2022-3358)
In
Palo Alto
PAN-SA-2022-0006 Impact of OpenSSL 3.0 Vulnerabilities CVE-2022-3786 and CVE-2022-3602
vendor_paloalto·2022-10-31·CVSS 7.5
CVE-2022-3602 [HIGH] PAN-SA-2022-0006 Impact of OpenSSL 3.0 Vulnerabilities CVE-2022-3786 and CVE-2022-3602
PAN-SA-2022-0006 Impact of OpenSSL 3.0 Vulnerabilities CVE-2022-3786 and CVE-2022-3602
The OpenSSL Project has published two high
CVEs: CVE-2022-3602, CVE-2022-3786
Affected products: Cortex Data, Cortex XDR, Cortex XSOAR, Cortex Xpanse, GlobalProtect, PAN-OS, Prisma Access, Prisma Cloud, Prisma SD
Palo Alto
PAN-SA-2022-0006 Impact of OpenSSL 3.0 Vulnerabilities CVE-2022-3786 and CVE-2022-3602
vendor_paloalto·2022-10-31·CVSS 7.5
CVE-2022-3786 [HIGH] PAN-SA-2022-0006 Impact of OpenSSL 3.0 Vulnerabilities CVE-2022-3786 and CVE-2022-3602
PAN-SA-2022-0006 Impact of OpenSSL 3.0 Vulnerabilities CVE-2022-3786 and CVE-2022-3602
The OpenSSL Project has published two high
CVEs: CVE-2022-3602, CVE-2022-3786
Affected products: Cortex Data, Cortex XDR, Cortex XSOAR, Cortex Xpanse, GlobalProtect, PAN-OS, Prisma Access, Prisma Cloud, Prisma SD
Cisco
Vulnerabilities in OpenSSL Affecting Cisco Products: November 2022
vendor_cisco·2022-10-28·CVSS 7.5
CVE-2022-3602 [HIGH] Vulnerabilities in OpenSSL Affecting Cisco Products: November 2022
Vulnerabilities in OpenSSL Affecting Cisco Products: November 2022
On November 1, 2022, the OpenSSL Project announced the following vulnerabilities:
CVE-2022-3602 - X.509 Email Address 4-byte Buffer Overflow
CVE-2022-3786 - X.509 Email Address Variable Length Buffer Overflow
For a description of these vulnerabilities, see OpenSSL Security Advisory [Nov 1 2022].
This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-W9sdCc2a
Debian
CVE-2022-3786: openssl - A buffer overrun can be triggered in X.509 certificate verification, specificall...
vendor_debian·2022·CVSS 7.5
CVE-2022-3786 [HIGH] CVE-2022-3786: openssl - A buffer overrun can be triggered in X.509 certificate verification, specificall...
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.
Scope: lo
Cisco
Vulnerabilities in OpenSSL Affecting Cisco Products: November 2022
vendor_cisco·CVSS 3.1
CVE-2022-3786 Vulnerabilities in OpenSSL Affecting Cisco Products: November 2022
CVE-2022-3786: Vulnerabilities in OpenSSL Affecting Cisco Products: November 2022
On November 1, 2022, the OpenSSL Project announced the following vulnerabilities: CVE-2022-3602 - X.509 Email Address 4-byte Buffer Overflow CVE-2022-3786 - X.509 Email Address Variable Length Buffer Overflow For a description of these vulnerabilities, see OpenSSL Security Advisory [Nov 1 2022] . This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-W9sdCc2a
CVSS: 3.1
Bug IDs: CSCwd44110, CSCwd44112
Cisco
Vulnerabilities in OpenSSL Affecting Cisco Products: November 2022
vendor_cisco·CVSS 3.1
CVE-2022-3602 Vulnerabilities in OpenSSL Affecting Cisco Products: November 2022
CVE-2022-3602: Vulnerabilities in OpenSSL Affecting Cisco Products: November 2022
On November 1, 2022, the OpenSSL Project announced the following vulnerabilities: CVE-2022-3602 - X.509 Email Address 4-byte Buffer Overflow CVE-2022-3786 - X.509 Email Address Variable Length Buffer Overflow For a description of these vulnerabilities, see OpenSSL Security Advisory [Nov 1 2022] . This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-W9sdCc2a
CVSS: 3.1
Bug IDs: CSCwd44110, CSCwd44112
GHSA
X.509 Email Address Variable Length Buffer Overflow
ghsa·2022-11-01
CVE-2022-3786 [HIGH] CWE-120 X.509 Email Address Variable Length Buffer Overflow
X.509 Email Address Variable Length Buffer Overflow
A buffer overrun can be triggered in X.509 certificate verification,
specifically in name constraint checking. Note that this occurs after
certificate chain signature verification and requires either a CA to
have signed a malicious certificate or for an application to continue
certificate verification despite failure to construct a path to a trusted
issuer. An attacker can craft a malicious email address in a certificate
to overflow an arbitrary number of bytes containing the `.` character
(decimal 46) on the stack. This buffer overflow could result in a crash
(causing a denial of service).
In a TLS client, this can be triggered by connecting to a malicious
server. In a TLS server, this can be triggered if the server requests
client aut
OSV
X.509 Email Address Variable Length Buffer Overflow
osv·2022-11-01
CVE-2022-3786 [HIGH] X.509 Email Address Variable Length Buffer Overflow
X.509 Email Address Variable Length Buffer Overflow
A buffer overrun can be triggered in X.509 certificate verification,
specifically in name constraint checking. Note that this occurs after
certificate chain signature verification and requires either a CA to
have signed a malicious certificate or for an application to continue
certificate verification despite failure to construct a path to a trusted
issuer. An attacker can craft a malicious email address in a certificate
to overflow an arbitrary number of bytes containing the `.` character
(decimal 46) on the stack. This buffer overflow could result in a crash
(causing a denial of service).
In a TLS client, this can be triggered by connecting to a malicious
server. In a TLS server, this can be triggered if the server requests
client aut
OSV
CVE-2022-3786: A buffer overrun can be triggered in X
osv·2022-11-01·CVSS 7.5
CVE-2022-3786 [HIGH] CVE-2022-3786: A buffer overrun can be triggered in X
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.
OSV
openssl vulnerabilities
osv·2022-11-01·CVSS 7.5
CVE-2022-3602 [HIGH] openssl vulnerabilities
openssl vulnerabilities
It was discovered that OpenSSL incorrectly handled certain X.509 Email
Addresses. If a certificate authority were tricked into signing a
specially-crafted certificate, a remote attacker could possibly use this
issue to cause OpenSSL to crash, resulting in a denial of service. The
default compiler options for affected releases reduce the vulnerability to
a denial of service. (CVE-2022-3602, CVE-2022-3786)
It was discovered that OpenSSL incorrectly handled applications creating
custom ciphers via the legacy EVP_CIPHER_meth_new() function. This issue
could cause certain applications that mishandled values to the function to
possibly end up with a NULL cipher and messages in plaintext.
(CVE-2022-3358)
No detection rules found.
No public exploits indexed.
Tenable
Mind the Gap: A Closer Look at the Vulnerabilities Disclosed in 2022
blogs_tenable·2023-05-09
Mind the Gap: A Closer Look at the Vulnerabilities Disclosed in 2022
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
November 2022 Patch Tuesday | Microsoft Releases 65 New Vulnerabilities With 10 Critical; Adobe Releases Zero Advisories (for the First Time in Six Years).
blogs_qualys·2022-11-08·CVSS 7.5
[HIGH] November 2022 Patch Tuesday | Microsoft Releases 65 New Vulnerabilities With 10 Critical; Adobe Releases Zero Advisories (for the First Time in Six Years).
## Table of Contents
Microsoft Patch Tuesday Summary
The November 2022 Microsoft Vulnerabilities are Classified as Follows:
OpenSSL 3.x Critical Vulnerability Highlights
OpenSSL 3.x Related Blogs and Resources
Microsoft Addressed Six Zero-Day Vulnerabilities
Microsoft Patch Tuesday Critical Vulnerability Highlights
Microsoft Release Summary
Adobe Security Bulletins and Advisories
About Qualys Patch Tuesday
Qualys Threat Research Blog Posts
Qualys Threat Protection High-Rated Advisories
Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response(VMDR)
Rapid Response with Patch Management (PM)
Extend the Power of VMDR to Enterprise Mobile Devices With Qualys VMDR Mobile
Execute Mitigation UsingCustom Assessment and Remediation(CAR)
Patch Tuesday Is
Tenable
Microsoft’s November 2022 Patch Tuesday Addresses 62 CVEs (CVE-2022-41073)
blogs_tenable·2022-11-08·CVSS 7.8
[HIGH] Microsoft’s November 2022 Patch Tuesday Addresses 62 CVEs (CVE-2022-41073)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
November 2022 Patch Tuesday | Microsoft Releases 65 New Vulnerabilities With 10 Critical; Adobe Releases Zero Advisories (for the First Time in Six Years). | Qualys
blogs_qualys·2022-11-08·CVSS 7.5
[HIGH] November 2022 Patch Tuesday | Microsoft Releases 65 New Vulnerabilities With 10 Critical; Adobe Releases Zero Advisories (for the First Time in Six Years). | Qualys
#### Table of Contents
- Microsoft Patch Tuesday Summary
- The November 2022 Microsoft Vulnerabilities are Classified as Follows:
- OpenSSL 3.x Critical Vulnerability Highlights
- OpenSSL 3.x Related Blogs and Resources
- Microsoft Addressed Six Zero-Day Vulnerabilities
- Microsoft Patch Tuesday Critical Vulnerability Highlights
- Microsoft Release Summary
- Adobe Security Bulletins and Advisories
- About Qualys Patch Tuesday
- Qualys Threat Research Blog Posts
- Qualys Threat Protection High-Rated Advisories
- Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response(VMDR)
- Rapid Response with Patch Management (PM)
- Extend the Power of VMDR to Enterprise Mobile Devices With Qualys VMDR Mobile
- Execute Mitigation UsingCustom Assessment and Remediation(CAR)
Checkpoint
7th November– Threat Intelligence Report
blogs_checkpoint·2022-11-07
CVE-2022-3602 7th November– Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 7th November– Threat Intelligence Report
For the latest discoveries in cyber research for the week of 7th November, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Two European automotive companies were hit by ransomware – The German multinational group Continental was hit by LockBit ransomware gang and the breached data has been published on Lockbit’s leak site. Italian company Landi Renzo was breached by Hive.
Check Point Harmony Endpoint, Anti-Bot and Threat Emulation provide pro
Unit42
Threat Brief: CVE-2022-3786 and CVE-2022-3602: OpenSSL X.509 Buffer Overflows
blogs_unit42·2022-11-03·CVSS 7.5
CVE-2022-3786 [HIGH] Threat Brief: CVE-2022-3786 and CVE-2022-3602: OpenSSL X.509 Buffer Overflows
Threat Research Center
High Profile Threats
Vulnerabilities
## Threat Brief: CVE-2022-3786 and CVE-2022-3602: OpenSSL X.509 Buffer Overflows
Shawn Westfall
Published: November 2, 2022
High Profile Threats
Vulnerabilities
Buffer Overflow
CVE-2022-3602
CVE-2022-3786
Network security
OpenSSL
## Executive Summary
On November 1, 2022, OpenSSL released a security advisory describing two high severity vulnerabilities within the OpenSSL library ( CVE-2022-3786 and CVE-2022-3602 ). OpenSSL versions from 3.0.0 - 3.0.6 are vulnerable, with 3.0.7 containing the patch for both vulnerabilities. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.
In the days leading up to the security advisory, many were saying these vulnerabilities had the potential to be as bad as the Heartbleed
Unit42
Threat Brief: CVE-2022-3786 and CVE-2022-3602: OpenSSL X.509 Buffer Overflows
blogs_unit42·2022-11-03·CVSS 7.5
CVE-2022-3786 [HIGH] Threat Brief: CVE-2022-3786 and CVE-2022-3602: OpenSSL X.509 Buffer Overflows
## Executive Summary
On November 1, 2022, OpenSSL released a security advisory describing two high severity vulnerabilities within the OpenSSL library (CVE-2022-3786 and CVE-2022-3602). OpenSSL versions from 3.0.0 - 3.0.6 are vulnerable, with 3.0.7 containing the patch for both vulnerabilities. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.
In the days leading up to the security advisory, many were saying these vulnerabilities had the potential to be as bad as the Heartbleed vulnerability, and even OpenSSL originally stated that CVE-2022-3602 was going to be rated critical. Several factors seem to indicate that these vulnerabilities will not be easy to exploit and pose much less risk than originally thought:
- Both vulnerabilities require a malicious X.509 certificate that has
Sentinelone
Everything You Need To Know About OpenSSL Vulnerabilities
blogs_sentinelone·2022-11-02·CVSS 7.5
CVE-2022-3786 [HIGH] Everything You Need To Know About OpenSSL Vulnerabilities
OpenSSL Project released OpenSSL version 3.0.7 on November 1st, 2022 to address specific vulnerabilities (CVE-2022-3786 and CVE-2022-3602) that had been largely unknown until today.
The new version will fix these High severity vulnerabilities in the library affecting OpenSSL versions 3.0.0 and above, as well as any application with an embedded, impacted OpenSSL library.
An important thing to note is that this is only the second time since 2014 that OpenSSL has categorized an issue/vulnerability as Critical, but then it was changed to High.
Let’s dive into the details and understand how it impacts us.
## What is OpenSSL?
OpenSSL is a cryptographic library that offers an open-source application of the TLS protocol used for encrypting communications on the Internet. First released in 199
Sentinelone
Everything You Need To Know About OpenSSL Vulnerabilities
blogs_sentinelone·2022-11-02·CVSS 7.5
CVE-2022-3786 [HIGH] Everything You Need To Know About OpenSSL Vulnerabilities
OpenSSL Project released OpenSSL version 3.0.7 on November 1st, 2022 to address specific vulnerabilities (CVE-2022-3786 and CVE-2022-3602) that had been largely unknown until today.
The new version will fix these High severity vulnerabilities in the library affecting OpenSSL versions 3.0.0 and above, as well as any application with an embedded, impacted OpenSSL library.
An important thing to note is that this is only the second time since 2014 that OpenSSL has categorized an issue/vulnerability as Critical, but then it was changed to High.
Let’s dive into the details and understand how it impacts us.
## What is OpenSSL?
OpenSSL is a cryptographic library that offers an open-source application of the TLS protocol used for encrypting communications on the Internet. First released in 199
Tenable
CVE-2022-3786 and CVE-2022-3602: OpenSSL Patches Two High Severity Vulnerabilities
blogs_tenable·2022-11-01·CVSS 7.5
[HIGH] CVE-2022-3786 and CVE-2022-3602: OpenSSL Patches Two High Severity Vulnerabilities
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
Threat Advisory: High Severity OpenSSL Vulnerabilities
blogs_talos·2022-11-01·CVSS 7.5
CVE-2022-3602 [HIGH] Threat Advisory: High Severity OpenSSL Vulnerabilities
In late October two new buffer overflow vulnerabilities, CVE-2022-3602 and CVE-2022-3786, were announced in OpenSSL versions 3.0.0 to 3.0.6. These vulnerabilities can be exploited by sending an X.509 certificate with a specially crafted email address, potentially causing a buffer overflow resulting in a crash or remote code execution (RCE). X.509 is the standard defining the format of public key certificates, commonly used in protocols including TLS as well as digital signatures. Importantly, these vulnerabilities can affect both the client and server in contrast to most vulnerabilities that typically impact one or the other, broadening the potential attack surface.
These vulnerabilities could be very impactful as OpenSSL is widely used, and the affected version is included in some major
Zscaler
Security Advisory for OpenSSL Vulnerabilities | Zscaler Blog
blogs_zscaler·2022-11-01·CVSS 7.5
[HIGH] Security Advisory for OpenSSL Vulnerabilities | Zscaler Blog
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Talos
Threat Advisory: High Severity OpenSSL Vulnerabilities
blogs_talos·2022-11-01·CVSS 7.5
CVE-2022-3602 [HIGH] Threat Advisory: High Severity OpenSSL Vulnerabilities
## Threat Advisory: High Severity OpenSSL Vulnerabilities
In late October two new buffer overflow vulnerabilities, CVE-2022-3602 and CVE-2022-3786 , were announced in OpenSSL versions 3.0.0 to 3.0.6. These vulnerabilities can be exploited by sending an X.509 certificate with a specially crafted email address, potentially causing a buffer overflow resulting in a crash or remote code execution (RCE). X.509 is the standard defining the format of public key certificates, commonly used in protocols including TLS as well as digital signatures. Importantly, these vulnerabilities can affect both the client and server in contrast to most vulnerabilities that typically impact one or the other, broadening the potential attack surface.
These vulnerabilities could be very impactful as OpenSSL is wide
Tenable
What You Should Know about the New OpenSSL Vulnerability
blogs_tenable·2022-10-31
What You Should Know about the New OpenSSL Vulnerability
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Sentinelone
OpenSSL 3 Critical Vulnerability | What Do Organizations Need To Do Now?
blogs_sentinelone·2022-10-31·CVSS 7.5
CVE-2022-3786 [HIGH] OpenSSL 3 Critical Vulnerability | What Do Organizations Need To Do Now?
Last week, the OpenSSL project team announced the release of OpenSSL version 3.0.7, which was made available on Tuesday, November 1st. The update is a security fix for two vulnerabilities in OpenSSL 3.0.x, and developers and organizations are being urged to ensure that they patch any instances of OpenSSL 3 in their software stack as a matter of urgency. The vulnerabilities, CVE-2022-3786 and CVE-2022-3602, affect version 3.0.x and do not impact OpenSSL 1.1.1 or LibreSSL.
SentinelOne customers have instant visibility of OpenSSL versions within their organizations. As such, Singularity XDR is a useful visibility solution in ensuring your organization is ready for the OpenSSL 3 update.
## What is OpenSSL?
OpenSSL is an open-source cryptography library widely used by applications, operating
Sentinelone
OpenSSL 3 Critical Vulnerability | What Do Organizations Need To Do Now?
blogs_sentinelone·2022-10-31·CVSS 7.5
CVE-2022-3786 [HIGH] OpenSSL 3 Critical Vulnerability | What Do Organizations Need To Do Now?
Last week, the OpenSSL project team announced the release of OpenSSL version 3.0.7, which was made available on Tuesday, November 1st. The update is a security fix for two vulnerabilities in OpenSSL 3.0.x , and developers and organizations are being urged to ensure that they patch any instances of OpenSSL 3 in their software stack as a matter of urgency. The vulnerabilities, CVE-2022-3786 and CVE-2022-3602, affect version 3.0.x and do not impact OpenSSL 1.1.1 or LibreSSL.
SentinelOne customers have instant visibility of OpenSSL versions within their organizations. As such, Singularity XDR is a useful visibility solution in ensuring your organization is ready for the OpenSSL 3 update.
## What is OpenSSL?
OpenSSL is an open-source cryptography library widely used by applications, operatin
Qualys
Qualys Research Alert: OpenSSL 3.0.7 – What You Need To Know
blogs_qualys·2022-10-31·CVSS 7.5
CVE-2022-3786 [HIGH] Qualys Research Alert: OpenSSL 3.0.7 – What You Need To Know
## Table of Contents
What is OpenSSL?
What is OpenSSL Vulnerability CVE-2022-3786 & CVE-2022-3602?
Vulnerable Versions
What Should Organizations Do?
How Can Qualys Help?
Discover Vulnerable Instances Using Qualys VMDR
Discover Vulnerable Container Images Using Qualys Container Security (CS)
Discover Vulnerable Instances Using Qualys Web Application Scanning (WAS)
Patch Vulnerable Systems Using Qualys Patch Management (PM)
Initiate Endpoint Response Actions Using Custom Assessment and Remediation (CAR)
We encourage our customers to leverage our Vulnerability Detection Pipelineto track new vulnerability detection development and status.
Frequently Asked Questions
On Tuesday, November 1, 2022, the OpenSSL project released version 3.0.7 of OpenSSL, an update that patches two buffe
Qualys
OpenSSL 3.0.7 Vulnerabilities | Qualys Research Alert | Qualys
blogs_qualys·2022-10-31·CVSS 7.5
CVE-2022-3786 [HIGH] OpenSSL 3.0.7 Vulnerabilities | Qualys Research Alert | Qualys
#### Table of Contents
- What is OpenSSL?
- What is OpenSSL Vulnerability CVE-2022-3786 & CVE-2022-3602?
- Vulnerable Versions
- What Should Organizations Do?
- How Can Qualys Help?
- Discover Vulnerable Instances Using Qualys VMDR
- Discover Vulnerable Container Images Using Qualys Container Security (CS)
- Discover Vulnerable Instances Using Qualys Web Application Scanning (WAS)
- Patch Vulnerable Systems Using Qualys Patch Management (PM)
- Initiate Endpoint Response Actions Using Custom Assessment and Remediation (CAR)
- We encourage our customers to leverage our Vulnerability Detection Pipelineto track new vulnerability detection development and status.
- Frequently Asked Questions
On Tuesday, November 1, 2022, the OpenSSL project released version 3.0.7 of OpenSSL, an update that pa
Wiz
OpenSSL vulnerabilities: Everything you need to know | Wiz Blog
blogs_wiz·2022-10-29·CVSS 7.5
CVE-2022-3602 [HIGH] OpenSSL vulnerabilities: Everything you need to know | Wiz Blog
TL;DR: OpenSSL Project released two new vulnerabilities, CVE-2022-3602 and CVE-2022-3786, which are less severe than previously announced. According to Wiz Research, these buffer overflow vulnerabilities are hard to exploit and require specific exploits per target application; the likelihood of generic, mass exploitation attempts of clients/servers that utilize the OpenSSL 3 library is low. Moreover, Wiz data shows only 1.5% of OpenSSL instances are impacted versions.
*This blog was updated on November 1st, 2022 following OpenSSL Project's patch release.
## What we know about the OpenSSL vulnerabilities so far
OpenSSL is a cryptographic library that is universally used for encrypting communications on the Internet. It is widely used by Internet servers, including the majority of HTTPS w
Wiz
OpenSSL vulnerabilities: Everything you need to know | Wiz Blog
blogs_wiz·2022-10-29·CVSS 7.5
CVE-2022-3602 [HIGH] OpenSSL vulnerabilities: Everything you need to know | Wiz Blog
TL;DR: OpenSSL Project released two new vulnerabilities, CVE-2022-3602 and CVE-2022-3786, which are less severe than previously announced. According to Wiz Research, these buffer overflow vulnerabilities are hard to exploit and require specific exploits per target application; the likelihood of generic, mass exploitation attempts of clients/servers that utilize the OpenSSL 3 library is low. Moreover, Wiz data shows only 1.5% of OpenSSL instances are impacted versions.
*This blog was updated on November 1st, 2022 following OpenSSL Project's patch release.
## What we know about the OpenSSL vulnerabilities so far
OpenSSL is a cryptographic library that is universally used for encrypting communications on the Internet. It is widely used by Internet servers , including the majority of HTTPS
Tenable
Tenable Network Security Podcast Episode 204 - "OpenSSL Again, Back to Basics"
blogs_tenable·2014-06-05
Tenable Network Security Podcast Episode 204 - "OpenSSL Again, Back to Basics"
Blog /
Subscribe
# Tenable Network Security Podcast Episode 204 - "OpenSSL Again, Back to Basics"
Paul Asadoorian
June 5, 2014
3 Min Read
### Announcements
- We're hiring! - Visit the Tenable website for more information about open positions.
- Tenable Named one of the Coolest Companies in Baltimore
- Want to ask questions about Nessus, SecurityCenter, LCE, and PVS and get answers from the experts at Tenable? Join Tenable's Discussion Forum for custom scripts, announcements, and more!
- You can find links to subscribe to Tenable's Podcast feed, YouTube Channel, Twitter and Facebook accounts at http://www.tenable.com/podcast!
1. Your devices Heartbleeding - again
2. 'Son Of Heartbleed' Hits Android And WiFi Networks
3. Compliance: The Surprising Gift Of Windows XP
4. Linux users at r
Tenable
Tenable Network Security Podcast Episode 204 - "OpenSSL Again, Back to Basics"
blogs_tenable·2014-06-05
Tenable Network Security Podcast Episode 204 - "OpenSSL Again, Back to Basics"
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
Tenable Network Security Podcast - Episode 200
blogs_tenable·2014-04-21
Tenable Network Security Podcast - Episode 200
Blog /
Subscribe
# Tenable Network Security Podcast - Episode 200
Paul Asadoorian
April 21, 2014
3 Min Read
### Announcements
- We're hiring! - Visit the Tenable website for more information about open positions.
- Want to ask questions about Nessus, SecurityCenter, LCE, and PVS and get answers from the experts at Tenable? Join Tenable's Discussion Forum for custom scripts, announcements, and more!
- You can find links to subscribe to Tenable's Podcast feed, YouTube Channel, Twitter and Facebook accounts at http://www.tenable.com/podcast!
### Discussion
- SCADA Device Vulnerability Detection - How do we do it? Scan, Sniff, Log, "Real-time" all these words come into play, but what do they really mean and how do they help you solve problems and reduce risk? How do we deal with XP in
Tenable
Tenable Network Security Podcast - Episode 200
blogs_tenable·2014-04-21
Tenable Network Security Podcast - Episode 200
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Zscaler
CISO Monthly Roundup, October 2022: ThreatLabz Data Loss Report; PHP Ducktail infostealer; LilithBot malware; vulnerabilities in OpenSSL, Microsoft, and Apache; Windows CLFS zero-day | CXO Revolutiona
blogs_zscaler
CISO Monthly Roundup, October 2022: ThreatLabz Data Loss Report; PHP Ducktail infostealer; LilithBot malware; vulnerabilities in OpenSSL, Microsoft, and Apache; Windows CLFS zero-day | CXO Revolutiona
## CISO Monthly Roundup, October 2022: ThreatLabz Data Loss Report; PHP Ducktail infostealer; LilithBot malware; vulnerabilities in OpenSSL, Microsoft, and Apache; Windows CLFS zero-day
Deepen Desai
Contributor
Zscaler
## Nov 2, 2022
The CISO Monthly Roundup (formerly the ThreatLabz monthly report) provides the latest threat research and relevant insights on cyber-related subjects from the ThreatLabz team and Deepen Desai, CISO at Zscaler.
The CISO Monthly Roundup (formerly the ThreatLabz monthly report) provides the latest threat research from Deepen Desai and the ThreatLabz team, along with insights on other cyber-related subjects. In October, ThreatLabz released their 2022 Data Loss Report, researched a PHP version of Ducktail infostealer, and analyzed LilithBot malware. My team a
Recorded Future
Top 5 Attack Surface Risks of 2022
blogs_recorded_future
Top 5 Attack Surface Risks of 2022
# Top 5 Attack Surface Risks of 2022
In a bid to contend with this year’s most prominent cyber threats, security teams everywhere have been forced to duly advance their understanding of what constitutes an attack surface.
A typical response from the community at large abides somewhere between the glaring redefinition of the traditional perimeter—that which incorporates the eroding, or blurring, of former demarcation lines—and the incidental yet insidious role of social engineering techniques ever threatening to run aground any significant defensive posture.
By contrast, cyber defense programs remain largely reactive and, frankly, quite disappointing at times. The idea of having an immersive, lessons-learned approach to security, whereby we generally assume to be faster in detecting atta
Greynoiseio
GreyNoise
blogs_greynoiseio·CVSS 7.5
[HIGH] GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Recorded Future
Top 5 Attack Surface Risks of 2022 | Recorded Future
blogs_recorded_future
Top 5 Attack Surface Risks of 2022 | Recorded Future
## Top 5 Attack Surface Risks of 2022
In a bid to contend with this year’s most prominent cyber threats, security teams everywhere have been forced to duly advance their understanding of what constitutes an attack surface .
A typical response from the community at large abides somewhere between the glaring redefinition of the traditional perimeter—that which incorporates the eroding, or blurring, of former demarcation lines—and the incidental yet insidious role of social engineering techniques ever threatening to run aground any significant defensive posture.
By contrast, cyber defense programs remain largely reactive and, frankly, quite disappointing at times. The idea of having an immersive, lessons-learned approach to security, whereby we generally assume to be faster in detecting at
Zscaler
CISO Monthly Roundup, November 2022: World Cup-related threats, renewed attacks on the Indian government, holiday shopping scams, and malware in the Google Play Store | CXO Revolutionaries
blogs_zscaler
CISO Monthly Roundup, November 2022: World Cup-related threats, renewed attacks on the Indian government, holiday shopping scams, and malware in the Google Play Store | CXO Revolutionaries
## CISO Monthly Roundup, November 2022: World Cup-related threats, renewed attacks on the Indian government, holiday shopping scams, and malware in the Google Play Store
Deepen Desai
Contributor
Zscaler
## Dec 2, 2022
The November CISO Monthly Roundup explores World Cup-related threats, attacks targeting the Indian government, holiday season scams, and more.
The CISO Monthly Roundup provides the latest threat research from Deepen Desai and the ThreatLabz team, along with insights on other cyber-related subjects. In November, ThreatLabz uncovered several World Cup-related threats, new attacks on the Indian government, holiday skimming scams, and malware in the Google Play Store.
## Surge of fake FIFA World Cup streaming sites
ThreatLabz is always watching for spikes in malicious act
Bugzilla
CVE-2022-3786 OpenSSL: X.509 Email Address Variable Length Buffer Overflow
bugzilla·2022-11-01·CVSS 7.5
CVE-2022-3786 [HIGH] CVE-2022-3786 OpenSSL: X.509 Email Address Variable Length Buffer Overflow
CVE-2022-3786 OpenSSL: X.509 Email Address Variable Length Buffer Overflow
As per upstream report:
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service).
In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered
arXiv
Tweezers: A Framework for Security Event Detection via Event Attribution-centric Tweet Embedding
arxiv_fulltext·2024-09-12
Tweezers: A Framework for Security Event Detection via Event Attribution-centric Tweet Embedding
: A Framework for Security Event Detection via Event Attribution-centric Tweet Embedding
Jian Cui1 ,
Hanna Kim2,
Eugene Jang3,
Dayeon Yim3,
Kicheol Kim3,
Yongjae Lee3,
Jin-Woo Chung3,
Seungwon Shin2,
Xiaojing Liao1
1Indiana University Bloomington, 2KAIST, 3S2W Inc.
1\cuijian, xliao\@iu.edu, 2\gkssk3654, claude\@kaist.ac.kr, 3\genesith, dayeon, kkim, lee, jwchung\@s2w.inc
\@IEEEpubidpullup6.5
Network and Distributed System Security (NDSS) Symposium 2025
23–28 February 2025, San Diego, CA, USA
ISBN 979-8-9894372-8-3
https://dx.doi.org/10.14722/ndss.2025.23139
www.ndss-symposium.org
[ ]
Work performed while at S2W Inc.
## Abstract
Twitter is recognized as a crucial platform for the dissemination and gathering of Cyber Threat Intelligence (CTI). Its capability to provide real-tim
https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c42165b5706e42f67ef8ef4c351a9a4c5d21639ahttps://www.openssl.org/news/secadv/20221101.txthttps://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c42165b5706e42f67ef8ef4c351a9a4c5d21639ahttps://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00789.htmlhttps://www.kb.cert.org/vuls/id/794340https://www.openssl.org/news/secadv/20221101.txthttps://cert-portal.siemens.com/productcert/html/ssa-408105.html
2022-11-01
Published