OpenSSL 3.0.7 Patches Two High-Severity Flaws; Cloudflare Unaffected

On November 1, 2022, OpenSSL released version 3.0.7 to address two HIGH severity vulnerabilities: CVE-2022-3602 and CVE-2022-3786. Both are memory corruption issues found in the X.509 certificate verification code of the OpenSSL 3.0.x cryptographic library, potentially allowing attackers to execute arbitrary code on a victim's machine. CVE-2022-3602 was initially rated CRITICAL before being downgraded to HIGH, as remote code execution (RCE) is considered difficult to achieve. Notably, systems running earlier OpenSSL versions such as 1.1.1 are not vulnerable.

Cloudflare's products are not affected by these vulnerabilities, as the company uses BoringSSL instead of OpenSSL.

Exploitation Scenarios

Since the flaws live in X.509 certificate verification, they are most often triggered on the client side during TLS handshakes. For a client to be exploited, several conditions must align:

  • The victim must trust a Certificate Authority (CA) that signed the malicious certificate.
  • The victim must validate the certificate presented by a malicious site, or disregard browser warnings.
  • The victim must run an affected OpenSSL version (3.0.x before 3.0.7).

Servers running vulnerable OpenSSL versions can also be targeted, but only if they support mutual authentication, where the client presents a certificate containing the exploit payload to the server.

Patching and Detection

Administrators managing services that use OpenSSL should update their packages as soon as their Linux distribution provides OpenSSL 3.0.7. To check for processes dynamically loading OpenSSL, use the lsof command to inspect memory-mapped libraries. For example, to see NGINX using OpenSSL:

root@55f64f421576:/# lsof | grep libssl.so.3
nginx   1294     root  mem       REG              254,1           925009 /usr/lib/x86_64-linux-gnu/libssl.so.3 (path dev=0,142)

On Debian and Ubuntu systems, updating the libssl3 package via apt-get upgrade applies the fix:

root@55f64f421576:/# apt-get --only-upgrade install libssl3

Note that lsof will not detect statically compiled binaries that include the vulnerable OpenSSL code. Administrators should therefore audit any statically linked software they maintain and watch for operating system and third-party updates over the coming days.

Assessment and Recommendations

Cloudflare's adoption of BoringSSL meant the issue had no impact on its infrastructure ahead of the disclosure date. The vulnerabilities also serve as a reminder of the ongoing importance of memory safety in cryptographic software. While exploitation is constrained by the requirement for a trusted CA to sign a benign-looking malicious certificate—and CAs are likely to tighten certificate signing validation in response—the severity still warrants prompt patching. Upgrading all vulnerable OpenSSL installs to 3.0.7 is the recommended course of action.