CVE-2022-3786
Estado: ModificadaAlta (7.5)—
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service).
Leer descripción completaMostrar menos
In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 92%
- Percentil entre todas las CVEs puntuadas: 100
- Fecha de la puntuación: 30/9/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (3)
CWE
- CWE-120
- CWE-120
Referencias
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c42165b5706e42f67ef8ef4c351a9a4c5d21639a
- https://www.openssl.org/news/secadv/20221101.txt
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c42165b5706e42f67ef8ef4c351a9a4c5d21639a
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00789.html
- https://www.kb.cert.org/vuls/id/794340
- https://www.openssl.org/news/secadv/20221101.txt
- https://cert-portal.siemens.com/productcert/html/ssa-408105.html
JSON original (NVD)
Mostrar
{
"id": "CVE-2022-3786",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2022-3786",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-04-23T13:26:54.639858Z"
}
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "openssl-security@openssl.org",
"affectedData": [
{
"vendor": "OpenSSL",
"product": "OpenSSL",
"versions": [
{
"status": "affected",
"version": "3.0.0",
"lessThan": "3.0.7",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]
},
{
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"affectedData": [
{
"vendor": "Siemens",
"product": "Calibre ICE",
"versions": [
{
"status": "affected",
"version": "V2022.4",
"lessThan": "V2023.1",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "Mcenter",
"versions": [
{
"status": "affected",
"version": "V5.2.1",
"lessThan": "V5.3.0",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SCALANCE X204RNA (HSR)",
"versions": [
{
"status": "affected",
"version": "V3.2.7",
"lessThan": "V3.2.8",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SCALANCE X204RNA (PRP)",
"versions": [
{
"status": "affected",
"version": "V3.2.7",
"lessThan": "V3.2.8",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SCALANCE X204RNA EEC (HSR)",
"versions": [
{
"status": "affected",
"version": "V3.2.7",
"lessThan": "V3.2.8",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SCALANCE X204RNA EEC (PRP)",
"versions": [
{
"status": "affected",
"version": "V3.2.7",
"lessThan": "V3.2.8",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SCALANCE X204RNA EEC (PRP/HSR)",
"versions": [
{
"status": "affected",
"version": "V3.2.7",
"lessThan": "V3.2.8",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SICAM GridPass",
"versions": [
{
"status": "affected",
"version": "V1.80",
"lessThan": "V2.20",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SIMATIC RTLS Locating Manager",
"versions": [
{
"status": "affected",
"version": "V2.13.0.0",
"lessThan": "V2.13.0.3",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2022-11-01T18:15:11.047",
"references": [
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c42165b5706e42f67ef8ef4c351a9a4c5d21639a",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "openssl-security@openssl.org"
},
{
"url": "https://www.openssl.org/news/secadv/20221101.txt",
"tags": [
"Vendor Advisory"
],
"source": "openssl-security@openssl.org"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c42165b5706e42f67ef8ef4c351a9a4c5d21639a",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00789.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.kb.cert.org/vuls/id/794340",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.openssl.org/news/secadv/20221101.txt",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-408105.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-120"
}
]
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-120"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.\n\n"
},
{
"lang": "es",
"value": "Puede activarse una saturación del búfer en la verificación del certificado X.509, específicamente en la verificación de restricciones del nombre. Tenga en cuenta que esto ocurre después de la verificación de la firma de la cadena de certificados y requiere que una CA haya firmado un certificado malicioso o que la aplicación continúe con la verificación del certificado a pesar de no poder construir una ruta hacia un emisor confiable. Un atacante puede crear una dirección de correo electrónico maliciosa en un certificado para desbordar una cantidad arbitraria de bytes que contengan el carácter \".\" (decimal 46) en la pila de memoria. Este desbordamiento del búfer podría provocar un bloqueo (provocando una denegación de servicio). En un cliente TLS, esto se puede desencadenar conectándose a un servidor malicioso. En un servidor TLS, esto puede activarse si el servidor solicita la autenticación del cliente y se conecta un cliente malicioso."
}
],
"lastModified": "2026-06-17T05:00:18.193",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BE1F59CA-02F2-4374-A129-18713496B58B",
"versionEndExcluding": "3.0.7",
"versionStartIncluding": "3.0.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD"
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CAC42CA8-8B01-4A19-A83C-A7D4D08E5E43",
"versionEndExcluding": "18.11.0",
"versionStartIncluding": "18.0.0"
},
{
"criteria": "cpe:2.3:a:nodejs:node.js:18.12.0:*:*:*:lts:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7B1F87EE-4E30-4832-BF01-8501E94380EE"
},
{
"criteria": "cpe:2.3:a:nodejs:node.js:19.0.0:*:*:*:-:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F568BBC5-0D8E-499C-9F3E-DDCE5F10F9D5"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "openssl-security@openssl.org"
}