Advisory ID:

appd-sa-openssl-W9sdCc2a

CVE-2022-3602
CVE-2022-3786

First Published:

2022 November 02 18:00 PDT

Last Updated:

2022 November 03 16:00 PDT

Version 1.0:

Final

Workarounds:

No workarounds available

CVSS Score:

Base 7.5

Summary

On November 1, 2022, The OpenSSL Project announced two vulnerabilities (CVE-2022-3786 and CVE-2022-3602) affecting OpenSSL versions 3.0.0 through 3.0.6. OpenSSL released version 3.0.7 to address these vulnerabilities.

Both vulnerabilities exist in how OpenSSL performs X.509 certificate verification. CVE-2022-3786 is a High severity vulnerability. While CVE-2022-3602 was initially classified as Critical in severity, it was later downgraded to High by the OpenSSL security team. More detail is available from The OpenSSL Project at https://www.openssl.org/news/secadv/20221101.txt.

AppDynamics promptly analyzed these vulnerabilities and have found no impacts to our software. Some AppDynamics products make use of OpenSSL versions that are not affected by these vulnerabilities.

This advisory is intended to address those products deployed by AppDynamics customers on-premises which may require customers to take action.

The AppDynamics SaaS platform is continually monitored and improved. Should there be any impact from this vulnerability to our SaaS customers, we will communicate directly with those customers through standard support channels.


For questions about other Cisco products, see the Cisco Public Advisory.

This advisory is available at the following link: https://docs.appdynamics.com/display/PAA/Security+Advisory%3A+OpenSSL+Buffer+Overflow+Vulnerabilities

Affected Products

No AppDynamics products are known to be affected by these vulnerabilities.

Exploitation and Public Announcements

AppDynamics is not aware of any exploitation of the vulnerability described in this advisory.

Source

These vulnerabilities were publicly disclosed by The OpenSSL Project on November 1, 2022.

URL

https://docs.appdynamics.com/display/PAA/Security+Advisory%3A+OpenSSL+Buffer+Overflow+Vulnerabilities

Revision History

VersionDescriptionSectionStatusDate
1.0Initial public release.—Final

2022 November 03 16:00 PDT

LEGAL DISCLAIMER

ANY SOFTWARE OR RELEASES, INCLUDING BUT NOT LIMITED TO PATCHES, UPGRADES, AND HOTFIXES, MENTIONED IN THIS SECURITY ADVISORY IS PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND. APPDYNAMICS DISCLAIMS ALL REPRESENTATIONS OR WARRANTIES, EITHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE WITH RESPECT THERETO, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL APPDYNAMICS, ITS AFFILIATES, OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS, OR SPECIAL DAMAGES, EVEN IF THE OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY TO YOU. 

THE INFORMATION PROVIDED IN THIS SECURITY ADVISORY IS FOR INFORMATIONAL PURPOSES ONLY AND IN NO WAY SHALL BE CONSTRUED AS AN ALTERATION OF APPDYNAMICS’ EXISTING CONTRACTUAL OBLIGATIONS WITH ITS END USERS REGARDING VULNERABILITY MANAGEMENT OR OTHERWISE. END USERS ARE ENCOURAGED TO READ THE REQUIREMENTS SET FORTH HEREIN AND PERFORM THEIR OWN ANALYSIS OF THE APPLICABILITY AND IMPACT OF THE INFORMATION WITH RESPECT TO THEIR SPECIFIC CONFIGURATION AND USE CASE OF THE APPDYNAMICS SOFTWARE.