quidsup

There was an announcement that OpenSSL 3.0.7 was due to be released on 1st November 2022 and that it would contain a security-fix rated at Critical. This was subsequently over-hyped by the Infosec community, and the vulnerability was downgraded to High prior to the patch release.

Users of OpenSSL 3.0.0 to 3.0.6 should apply updates at your convenience. The vulnerability does not affect older releases of OpenSSL.

Vulnerabilities Patched: X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602) X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786)

Sources: https://mta.openssl.org/pipermail/openssl-announce/2022-October/000238.html https://www.cisa.gov/uscert/ncas/alerts/TA14-098A https://www.globalsign.com/en/blog/urgent-patch-openssl-november-1-avoid-critical-security-vulnerability https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/new-openssl-v3-vulnerability-prepare-with-microsoft-defender-for/ba-p/3666487 https://isc.sans.edu/forums/diary/Upcoming+Critical+OpenSSL+Vulnerability+What+will+be+Affected/29192 https://www.openssl.org/news/secadv/20221101.txt https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/

Like my channel? Please help support it: Paypal: https://www.paypal.me/quidsup

Follow me on Social Media Twitter: https://twitter.com/quidsup MeWe: https://mewe.com/i/quidsup Minds: https://minds.com/quidsup

#OpenSSL #CyberSecurity #OverHyped #QuidsupLinux