UBUNTU-CVE-2022-3786

See a problem?
Source
https://ubuntu.com/security/notices/UBUNTU-CVE-2022-3786
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-3786.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2022-3786
Related
Published
2022-11-01T00:00:00Z
Modified
2022-11-01T00:00:00Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.

References

Affected packages

Ubuntu:Pro:16.04:LTS / edk2

Package

Name
edk2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0~20150106.*

0~20150106.5c2d456b-2

0~20160104.*

0~20160104.c2a892d7-1

0~20160408.*

0~20160408.ffea0a2c-2
0~20160408.ffea0a2c-2ubuntu0.1
0~20160408.ffea0a2c-2ubuntu0.2
0~20160408.ffea0a2c-2ubuntu0.2+esm1

Ecosystem specific 

{
    "ubuntu_priority": "high"
}

Ubuntu:18.04:LTS / openssl

Package

Name
openssl
Purl
pkg:deb/ubuntu/openssl@1.1.1-1ubuntu2.1~18.04.20?arch=src?distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.1-1ubuntu2.1~18.04.20

Affected versions

1.*

1.0.2g-1ubuntu13
1.0.2g-1ubuntu14
1.0.2n-1ubuntu1
1.1.0g-2ubuntu1
1.1.0g-2ubuntu2
1.1.0g-2ubuntu3
1.1.0g-2ubuntu4
1.1.0g-2ubuntu4.1
1.1.0g-2ubuntu4.3
1.1.1-1ubuntu2.1~18.04.1
1.1.1-1ubuntu2.1~18.04.2
1.1.1-1ubuntu2.1~18.04.3
1.1.1-1ubuntu2.1~18.04.4
1.1.1-1ubuntu2.1~18.04.5
1.1.1-1ubuntu2.1~18.04.6
1.1.1-1ubuntu2.1~18.04.7
1.1.1-1ubuntu2.1~18.04.8
1.1.1-1ubuntu2.1~18.04.9
1.1.1-1ubuntu2.1~18.04.10
1.1.1-1ubuntu2.1~18.04.13
1.1.1-1ubuntu2.1~18.04.14
1.1.1-1ubuntu2.1~18.04.15
1.1.1-1ubuntu2.1~18.04.17
1.1.1-1ubuntu2.1~18.04.19

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "high",
    "binaries": [
        {
            "libssl-doc": "1.1.1-1ubuntu2.1~18.04.20",
            "libssl-dev": "1.1.1-1ubuntu2.1~18.04.20",
            "libssl1.1-dbgsym": "1.1.1-1ubuntu2.1~18.04.20",
            "libssl1.1-udeb": "1.1.1-1ubuntu2.1~18.04.20",
            "libssl1.1": "1.1.1-1ubuntu2.1~18.04.20",
            "openssl-dbgsym": "1.1.1-1ubuntu2.1~18.04.20",
            "libcrypto1.1-udeb": "1.1.1-1ubuntu2.1~18.04.20",
            "openssl": "1.1.1-1ubuntu2.1~18.04.20"
        }
    ]
}

Ubuntu:20.04:LTS / openssl

Package

Name
openssl
Purl
pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.16?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.1f-1ubuntu2.16

Affected versions

1.*

1.1.1c-1ubuntu4
1.1.1d-2ubuntu3
1.1.1d-2ubuntu6
1.1.1f-1ubuntu1
1.1.1f-1ubuntu2
1.1.1f-1ubuntu2.1
1.1.1f-1ubuntu2.2
1.1.1f-1ubuntu2.3
1.1.1f-1ubuntu2.4
1.1.1f-1ubuntu2.5
1.1.1f-1ubuntu2.8
1.1.1f-1ubuntu2.9
1.1.1f-1ubuntu2.10
1.1.1f-1ubuntu2.11
1.1.1f-1ubuntu2.12
1.1.1f-1ubuntu2.13
1.1.1f-1ubuntu2.15

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "high",
    "binaries": [
        {
            "libssl-doc": "1.1.1f-1ubuntu2.16",
            "libssl-dev": "1.1.1f-1ubuntu2.16",
            "libssl1.1-dbgsym": "1.1.1f-1ubuntu2.16",
            "libssl1.1-udeb": "1.1.1f-1ubuntu2.16",
            "libssl1.1": "1.1.1f-1ubuntu2.16",
            "openssl-dbgsym": "1.1.1f-1ubuntu2.16",
            "libcrypto1.1-udeb": "1.1.1f-1ubuntu2.16",
            "openssl": "1.1.1f-1ubuntu2.16"
        }
    ]
}

Ubuntu:22.04:LTS / openssl

Package

Name
openssl
Purl
pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.7?arch=src?distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.2-0ubuntu1.7

Affected versions

1.*

1.1.1l-1ubuntu1

3.*

3.0.0-1ubuntu1
3.0.1-0ubuntu1
3.0.2-0ubuntu1
3.0.2-0ubuntu1.1
3.0.2-0ubuntu1.2
3.0.2-0ubuntu1.4
3.0.2-0ubuntu1.5
3.0.2-0ubuntu1.6

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "high",
    "binaries": [
        {
            "libssl3": "3.0.2-0ubuntu1.7",
            "libssl-dev": "3.0.2-0ubuntu1.7",
            "openssl-dbgsym": "3.0.2-0ubuntu1.7",
            "openssl": "3.0.2-0ubuntu1.7",
            "libssl-doc": "3.0.2-0ubuntu1.7",
            "libssl3-dbgsym": "3.0.2-0ubuntu1.7"
        }
    ]
}