Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com
☎ 03 60 47 09 81 - info@securiteinfo.com
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.
No PoCs from references.
- https://github.com/ARPSyndicate/cve-scores
- https://github.com/ARPSyndicate/cvemon
- https://github.com/CVEDB/PoC-List
- https://github.com/CVEDB/awesome-cve-repo
- https://github.com/CVEDB/top
- https://github.com/GhostTroops/TOP
- https://github.com/IT-Relation-CDC/OpenSSL3.x-Scanner_win
- https://github.com/MrE-Fog/OpenSSL-2022
- https://github.com/NCSC-NL/OpenSSL-2022
- https://github.com/Qualys/osslscanwin
- https://github.com/WhatTheFuzz/openssl-fuzz
- https://github.com/XRSec/AWVS-Update
- https://github.com/akaganeite/CVE4PP
- https://github.com/alicangnll/SpookySSL-Scanner
- https://github.com/aneasystone/github-trending
- https://github.com/aoirint/nfs_ansible_playground_20221107
- https://github.com/async-knightbgt7/PyPinkSign
- https://github.com/bandoche/PyPinkSign
- https://github.com/colmmacc/CVE-2022-3602
- https://github.com/cybersecurityworks553/CVE-2022-3602-and-CVE-2022-3786
- https://github.com/endrazine/wcc-tests
- https://github.com/giterlizzi/secdb-feeds
- https://github.com/hi-artem/find-spooky-prismacloud
- https://github.com/hktalent/TOP
- https://github.com/itm8-CDC/OpenSSL3.x-Scanner_win
- https://github.com/jfrog/jfrog-openssl-tools
- https://github.com/k0mi-tg/CVE-POC
- https://github.com/kaosagnt/ansible-everyday
- https://github.com/manas3c/CVE-POC
- https://github.com/micr0sh0ft/certscare-openssl3-exploit
- https://github.com/mohammedamin01/Pawni
- https://github.com/mohammedamin01/mohammedamin01
- https://github.com/nomi-sec/PoC-in-GitHub
- https://github.com/philyuchkoff/openssl-RPM-Builder
- https://github.com/plharraud/cve-2022-3786
- https://github.com/protecode-sc/helm-chart
- https://github.com/rbowes-r7/cve-2022-3602-and-cve-2022-3786-openssl-poc
- https://github.com/roycewilliams/openssl-nov-1-critical-cve-2022-tracking
- https://github.com/sarutobi12/sarutobi12
- https://github.com/secure-rewind-and-discard/sdrad_utils
- https://github.com/tamus-cyber/OpenSSL-vuln-2022
- https://github.com/vulnersCom/vulners-sbom-parser
- https://github.com/weeka10/-hktalent-TOP
- https://github.com/whoforget/CVE-POC
- https://github.com/youwizard/CVE-POC