The OpenSSL Project recently patched two high-severity security flaws in its open-source cryptographic library used to encrypt communication channels and HTTPS connections.
These vulnerabilities (CVE-2022-3602 and CVE-2022-3786) impact OpenSSL version 3.0.0 and later and were addressed in OpenSSL 3.0.7.
CVE-2022-3602 can be exploited to cause crashes or remote code execution (RCE), while CVE-2022-3786 can be utilized by threat actors through malicious email addresses to trigger a denial of service state.
“We still consider these issues to be serious vulnerabilities and affected users are encouraged to upgrade as soon as possible,” the OpenSSL team said in a statement on Tuesday.
“We are not aware of any working exploit that could lead to remote code execution, and we have no evidence of these issues being exploited as of the time of release of this post,” it added.
According to OpenSSL’s security policy, companies (like ExpressVPN) and IT admins were warned last week to search their environments for vulnerabilities and prepare to patch them once OpenSSL 3.0.7 was released.
“If you know in advance where you are using OpenSSL 3.0+ and how you are using it then when the advisory comes you’ll be able to quickly determine if or how you’re affected and what you need to patch,” said OpenSSL founder Mark J Cox in a Twitter post.
OpenSSL also provided mitigation measures requiring admins operating Transport Layer Security (TLS) servers to disable TLS client authentication until the patches were applied.
The impact of the vulnerabilities were much more limited than initially thought given that CVE-2022-3602 was downgraded from critical to high-severity and only impacts OpenSSL 3.0 and later instances.
Per cloud security firm Wiz.io, only 1.5% of all OpenSSL instances were found to be impacted by the security flaw after analyzing deployments across major cloud environments (including, AWS, GCP, Azure, OCI, and Alibaba Cloud).
The Netherlands’ National Cyber Security Centre also shared a list of software products confirmed to remain not impacted by the OpenSSL vulnerability.