{"id":105445,"date":"2022-11-02T03:36:49","date_gmt":"2022-11-02T01:36:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/perepolnenie-bufera-v-openssl-ekspluatiruemoe-pri-proverke-sertifikatov-x-509"},"modified":"2022-11-02T03:36:49","modified_gmt":"2022-11-02T01:36:49","slug":"perepolnenie-bufera-v-openssl-ekspluatiruemoe-pri-proverke-sertifikatov-x-509","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/perepolnenie-bufera-v-openssl-ekspluatiruemoe-pri-proverke-sertifikatov-x-509","title":{"rendered":"Buffer overflow in OpenSSL, exploited when checking X.509 certificates.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A corrective release of the cryptographic library OpenSSL 3.0.7 has been published, addressing two vulnerabilities. Both issues are caused by a buffer overflow in the email field validation code in X.509 certificates and could potentially lead to code execution when processing a specially crafted certificate. At the time of the fix\u2019s publication, no working exploit capable of executing code had been reported by the OpenSSL developers. <\/p>\n
Although the prior announcement of the new release mentioned a critical issue, the vulnerability's status in the released update was actually lowered to that of serious but non-critical. According to the project's established rules, the severity level is reduced if the issue manifests in atypical configurations or if there is a low probability of practical exploitation. <\/p>\n
In this case, the severity level was lowered as a detailed analysis of the vulnerability by several organizations concluded that the possibility of code execution during exploitation is blocked by the protection mechanisms against stack overflow used in many platforms. Additionally, the network layout used in some Linux distributions causes the out-of-bounds 4 bytes to overlap with the subsequent unused buffer in the stack. However, it is not excluded that there are platforms where exploitation for code execution is possible. <\/p>\n