OpenSSL 3.0.7 Released to Fix Two High-Severity Buffer Overflows

What happened

On November 1, 2022, the OpenSSL project released OpenSSL 3.0.7 alongside a security advisory fixing two vulnerabilities in X.509 certificate verification: CVE-2022-3602 and CVE-2022-3786. Both were rated high severity. The release had been unusually pre-announced a week in advance, which prompted widespread preparation across the industry given OpenSSL's ubiquity.

The technical facts

According to the OpenSSL advisory, both issues are buffer overruns triggered during X.509 certificate verification, specifically in name-constraint checking, which occurs after certificate-chain signature verification. CVE-2022-3602 allows an attacker to craft a malicious email address to overflow four attacker-controlled bytes on the stack, which could cause a crash or potentially remote code execution. CVE-2022-3786 allows overflowing an arbitrary number of bytes containing the period character, which could cause a crash, a denial of service.

From critical to high

OpenSSL stated that pre-announcements had described CVE-2022-3602 as critical, but further analysis of mitigating factors, such as stack-overflow protections on many platforms and the specifics of stack layout per platform and compiler, led the project to downgrade it to high. The advisory noted that in a TLS client the issue can be triggered by connecting to a malicious server, and in a TLS server it can be triggered if the server requests client authentication and a malicious client connects. OpenSSL said it was not aware of any working exploit leading to code execution at the time of release.

Affected versions and remediation

The advisory stated that OpenSSL versions 3.0.0 through 3.0.6 are vulnerable and that OpenSSL 3.0 users should upgrade to 3.0.7. Importantly, OpenSSL 1.1.1 and 1.0.2 are not affected, which limited the real-world impact because many deployments were still on the 1.1.1 series. OpenSSL credited the reports to a researcher under the name Polar Bear (CVE-2022-3602) and to Viktor Dukhovni (CVE-2022-3786), with fixes developed by Dr Paul Dale.

Why it mattered

Because OpenSSL underpins TLS across much of the internet, the pre-announcement raised fears of another Heartbleed-scale event. In practice the impact was more contained: only the newer 3.0 series was affected, exploitation for code execution was considered difficult, and no working exploit was known at release. The episode was widely cited as an example of measured disclosure and of the value of clear, primary-source advisories over early speculation.

Related on Skillo

See also: the Log4Shell vulnerability in Apache Log4j, the regreSSHion OpenSSH vulnerability.

Sources

• OpenSSL Security Advisory (1 November 2022)

Published date reflects the original event date (2022-11-01). This article is original Skillo editorial written from the sources above; facts were verified in September 2026.