Improper Resource Shutdown or Release Affecting openssl package, versions <1:3.0.1-41.el9_0


Severity

Recommended
medium

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.34% (73rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL9-OPENSSL-5571455
  • published7 Jun 2022
  • disclosed3 May 2022

Introduced: 3 May 2022

CVE-2022-1473  (opens in a new tab)
CWE-404  (opens in a new tab)
CWE-401  (opens in a new tab)

How to fix?

Upgrade RHEL:9 openssl to version 1:3.0.1-41.el9_0 or higher.
This issue was patched in RHSA-2022:6224.

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by RHEL. See How to fix? for RHEL:9 relevant fixed versions and status.

The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).

CVSS Scores

version 3.1