Homepage

Buffer Overflow The advisory has been revoked - it doesn't affect any version of package openssl  (opens in a new tab)

Threat Intelligence

Exploit Maturity
Proof of Concept
EPSS
90.77% (100th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU2510-OPENSSL-15737055
  • published21 Mar 2026
  • disclosed1 Nov 2022
Report a new vulnerability Found a mistake?

Introduced: 1 Nov 2022

CVE-2022-3602  (opens in a new tab)
CWE-120  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:25.10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu.

in X.509 certificate verification, specifically in name constraint checking, by allowing an attacker to craft a malicious email address to overflow an arbitrary number of bytes containing the . character (decimal 46) on the stack. Note This occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.

Changelog

November 1, 2022 - Advisory published.

References