Published: 03/05/2022 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).

Vulnerable Product	Search on Vulmon	Subscribe to Product
openssl openssl
netapp santricity smi-s provider -
netapp clustered data ontap -
netapp smi-s provider -
netapp clustered data ontap antivirus connector -
netapp solidfire \\& hci management node -
netapp solidfire\\, enterprise sds \\& hci storage node -
netapp active iq unified manager -
netapp snapmanager -
netapp a700s_firmware -
netapp h300s_firmware -
netapp h500s_firmware -
netapp h700s_firmware -
netapp h300e_firmware -
netapp h500e_firmware -
netapp h700e_firmware -
netapp h410s_firmware -
netapp aff_8300_firmware -
netapp fas_8300_firmware -
netapp aff_8700_firmware -
netapp fas_8700_firmware -
netapp aff_a400_firmware -
netapp fabric-attached_storage_a400_firmware -
netapp a250_firmware -
netapp aff_500f_firmware -
netapp fas_500f_firmware -

Synopsis Moderate: openssl security and bug fix update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for openssl is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this update as ...

Several security issues were fixed in OpenSSL ...

The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries This function is used when decoding certificates or keys If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be term ...

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection This script is distributed by some operating systems in a manner where it is automatically executed On such operating systems, an attacker could execute arbitrary commands with the privileges of the script Use of the c_rehash script is considered obs ...

Critical Infrastructure Sectors: Critical Manufacturing

CWE-459 https://www.openssl.org/news/secadv/20220503.txt https://security.netapp.com/advisory/ntap-20220602-0009/https://security.gentoo.org/glsa/202210-02 https://cert-portal.siemens.com/productcert/pdf/ssa-953464.pdf https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=64c85430f95200b6b51fe9475bd5203f7c19daf1 https://access.redhat.com/errata/RHSA-2022:6224 https://nvd.nist.gov https://ubuntu.com/security/notices/USN-5402-2 https://www.cisa.gov/uscert/ics/advisories/icsa-23-047-03

CVE-2022-1473

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

References

Vulmon Search

About

Products

Connect