Inadequate Encryption Strength in OpenSSL - CVE-2022-3358

Vulnerability identifier: #VU68116

CSH Severity: Medium

CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-3358

CWE-ID: CWE-326

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to decrypt traffic.

The vulnerability exists due to an error in openssl implementation when handling legacy custom ciphers with NID_undef passed to the EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() and EVP_CipherInit_ex2() functions. Under certain conditions openssl can fail to select a proper cipher and use NULL instead, which corresponds to sending data in plain text.

Note, applications are only affected by this issue if they call EVP_CIPHER_meth_new() using NID_undef and subsequently use it in a call to an encryption/decryption initialisation function.

OpenSSL
Amazon Linux AMI
Gentoo Linux
Oracle Linux
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
IBM AIX
Fedora
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Desktop
openSUSE Leap
Ubuntu
Red Hat OpenShift Container Platform
Splunk AppDynamics Analytics Agent
Splunk AppDynamics Machine Agent
IBM Integrated Analytics System
libopenssl-3-devel
libopenssl3
libopenssl3-debuginfo
openssl-3
openssl-3-debuginfo
openssl-3-debugsource
libopenssl-3-devel-32bit
libopenssl3-32bit
libopenssl3-32bit-debuginfo
openssl-3-doc
libssl3 (Ubuntu package)
openssl3
openssl (Red Hat package)
openssl
dev-libs/openssl
OpenShift Data Foundation (formerly OpenShift Container Storage)
App Connect Enterprise Certified Container

Install updates from vendor's website.

OpenSSL - update to 3.0.6
Red Hat OpenShift Container Platform - update to 4.13.2
IBM Integrated Analytics System - update to 1.0.30.0
libopenssl-3-devel - update to 3.0.1-150400.4.11.1
libopenssl3 - update to 3.0.1-150400.4.11.1
libopenssl3-debuginfo - update to 3.0.1-150400.4.11.1
openssl-3 - update to 3.0.1-150400.4.11.1
openssl-3-debuginfo - update to 3.0.1-150400.4.11.1
openssl-3-debugsource - update to 3.0.1-150400.4.11.1
libopenssl-3-devel-32bit - update to 3.0.1-150400.4.11.1
libopenssl3-32bit - update to 3.0.1-150400.4.11.1
libopenssl3-32bit-debuginfo - update to 3.0.1-150400.4.11.1
openssl-3-doc - update to 3.0.1-150400.4.11.1
libssl3 (Ubuntu package) - addressed in versions 3.0.2-0ubuntu1.7, 3.0.5-2ubuntu2
openssl3 - update to 3.0.7-5.el8.1
openssl (Red Hat package) - update to 3.0.7-6.el9_2
openssl - update to 3.0.8-1
dev-libs/openssl - update to 3.0.10
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.13.0
App Connect Enterprise Certified Container - update to 7.0.0
Splunk AppDynamics Analytics Agent - update to 25.7.0
Splunk AppDynamics Machine Agent - update to 25.7.0

• Exploit #8586 - SSL/TLS Version Detection (November 8, 2022)

• https://www.openssl.org/news/secadv/20221011.txt
• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=5485c56679d7c49b96e8fc8ca708b0b7e7c03c4b

• Failure to encrypt data in OpenSSL
• Ubuntu update for openssl
• SUSE update for openssl-3
• IBM AIX update for OpenSSL
• Red Hat Enterprise Linux 9 update for openssl
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.13
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Fedora EPEL 8 update for openssl3
• Multiple vulnerabilities in Red Hat OpenShift Container Platform release 4.13
• Gentoo update for OpenSSL
• Amazon Linux AMI update for openssl
• IBM Integrated Analytics System update for OpenSSL
• Splunk AppDynamics Analytics Agent update for third-party components
• Splunk AppDynamics Machine Agent update for third-party components