CVE-2022-3602
HighX.509 Email Address 4-byte Buffer Overflow
Published Nov 1, 2022 · Updated Oct 16, 2026 · Also known as ALPINE-CVE-2022-3602, BIT-node-2022-3602, BIT-node-min-2022-3602, DEBIAN-CVE-2022-3602, GHSA-8rwr-x37p-mx23, RUSTSEC-2022-0064, TR-22-0729, UBUNTU-CVE-2022-3602
Key Facts
Patch immediately- CVE-2022-3602 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Clustered Data Ontap (Netapp), Node.js (Nodejs), OpenSSL and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 91% probability of exploitation in the next 30 days.
- Fixed versions are available, including cargo-audit-advisory-db 20221102-1.1, libopenssl-3-devel 3.0.1-150400.4.11.1, libopenssl-3-devel 3.0.7-1.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
91%
Higher than 99.8% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2022-3602 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6).
Affected Products
125 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Clustered Data OntapNetapp | See advisory | n/a |
| Node.jsNodejs | 18.12.0, 19.0.0 | 18.11.0 |
| OpenSSLOpenssl | >= Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6) | 3.0.7 |
| FedoraFedoraproject | 26, 27, 36, 37 | n/a |
| nodejsalpine | See advisory | 18.12.1-r0 |
Patched Releases
cargo-audit-advisory-db
20221102-1.1
libopenssl-3-devel
3.0.1-150400.4.11.1, 3.0.7-1.1
libopenssl-3-devel-32bit
3.0.1-150400.4.11.1, 3.0.7-1.1
libopenssl3
3.0.1-150400.4.11.1, 3.0.7-1.1
libopenssl3-32bit
3.0.1-150400.4.11.1, 3.0.7-1.1
node
18.11.0, 18.12.1, 19.0.1
node-min
18.11.0, 18.12.1, 19.0.1
nodejs
1:18.12.1-1.amzn2023.0.2, 18.12.1-r0, 18.16.0-1.ph5, 18.20.8-1.ph4
Node.js
18.11.0
nodejs-devel
1:18.12.1-1.amzn2023.0.2, 18.16.0-1.ph5, 18.20.8-1.ph4
nodejs-docs
1:18.12.1-1.amzn2023.0.2
nodejs-full-i18n
1:18.12.1-1.amzn2023.0.2
nodejs-libs
1:18.12.1-1.amzn2023.0.2
npm
1:8.19.2-1.18.12.1.1.amzn2023.0.2
OpenSSL
1:3.0.1-43.0.1.el9_0, 1:3.0.1-43.el9_0, 1:3.0.5-1.amzn2022.0.3, 1:3.0.5-1.amzn2023.0.4, 1.1.1t-r35341999, 1.1.1w-0+deb11u2+sp999, 2:3.0.1-41.0.3.ksplice1.el9, 2:3.0.1-43.0.1.ksplice1.el9_0, 3.0.2-0ubuntu1.7, 3.0.6-2.ph4, 3.0.7, 3.0.7-1, 3.0.7-r0
openssl-3
3.0.1-150400.4.11.1, 3.0.7-1.1
openssl-3-doc
3.0.1-150400.4.11.1, 3.0.7-1.1
openssl-c_rehash
3.0.6-2.ph4
openssl-devel
1:3.0.1-43.0.1.el9_0, 1:3.0.5-1.amzn2022.0.3, 1:3.0.5-1.amzn2023.0.4, 2:3.0.1-41.0.3.ksplice1.el9, 2:3.0.1-43.0.1.ksplice1.el9_0, 3.0.6-2.ph4
openssl-docs
3.0.6-2.ph4
openssl-libs
1:3.0.1-43.0.1.el9_0, 1:3.0.5-1.amzn2022.0.3, 1:3.0.5-1.amzn2023.0.4, 2:3.0.1-41.0.3.ksplice1.el9, 2:3.0.1-43.0.1.ksplice1.el9_0
openssl-perl
1:3.0.1-43.0.1.el9_0, 1:3.0.5-1.amzn2022.0.3, 1:3.0.5-1.amzn2023.0.4, 2:3.0.1-41.0.3.ksplice1.el9, 2:3.0.1-43.0.1.ksplice1.el9_0, 3.0.6-2.ph4
openssl-provider-fips
3.0.8-r0
openssl-src
300.0.11
openssl3
3.0.7-r0
Timeline
Publicly disclosed
Nov 1, 2022
Last updated
Oct 16, 2026
Weakness Type
- CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
- CWE-787 Out-of-bounds Write
- CWE-805 Buffer Access with Incorrect Length Value
References
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3602
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3786
- advisoryRHSA-2022:7288
- advisoryRHSA-2022:7384
- advisoryhttps://blog.qualys.com/vulnerabilities-threat-research/2022/11/08/november-2022-patch-tuesday
FAQ
Common Questions.
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking.
Affected: Clustered Data Ontap (Netapp); Node.js (Nodejs) versions 18.12.0, 19.0.0; OpenSSL versions >= Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including cargo-audit-advisory-db 20221102-1.1, libopenssl-3-devel 3.0.1-150400.4.11.1, libopenssl-3-devel 3.0.7-1.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2022-3602 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo