{
  "cveId": "CVE-2022-3786",
  "url": "https://patchblox.com/security/cve/CVE-2022-3786",
  "summary": "CVE-2022-3786 is fixed in 21 products on 2 platforms, first by libssl3 3.0.2-0ubuntu1.7, released October 31, 2022. It is not reported as exploited, but the vendor rates exploitation more likely. Patch Radar priority: Urgent.",
  "title": "OpenSSL: CVE-2022-3786 X.509 certificate verification buffer overrun",
  "description": "A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the \u0060.\u0027 character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.",
  "published": "2022-10-31T17:00:00Z",
  "severity": "High",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "cwe": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
  "epss": 0.92488,
  "epssPercentile": 0.99827,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "exploitabilityAssessment": "Exploitation More Likely",
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-3786",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "Node.js 18",
      "fixedVersion": "18.12.1",
      "fix": "Node.js 18 18.12.1",
      "url": "https://patchblox.com/security/fix/windows-app/openjs.nodejs.18-18.12.1",
      "released": "2022-11-04T00:00:00Z"
    },
    {
      "platform": "windows-app",
      "product": "Node.js 19",
      "fixedVersion": "19.0.1",
      "fix": "Node.js 19 19.0.1",
      "url": "https://patchblox.com/security/fix/windows-app/openjs.nodejs.19-19.0.1",
      "released": "2022-11-04T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libssl3",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "3.0.2-0ubuntu1.7",
      "fix": "libssl3 3.0.2-0ubuntu1.7",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-libssl3-3.0.2-0ubuntu1.7",
      "released": "2022-10-31T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libssl3t64",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "3.0.5-2ubuntu2",
      "fix": "libssl3t64 3.0.5-2ubuntu2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-libssl3t64-3.0.5-2ubuntu2",
      "released": "2022-11-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libssl3t64",
      "release": "Ubuntu 25.04 (plucky)",
      "fixedVersion": "3.0.5-2ubuntu2",
      "fix": "libssl3t64 3.0.5-2ubuntu2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-libssl3t64-3.0.5-2ubuntu2",
      "released": "2022-11-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs",
      "release": "amzn 2023",
      "fixedVersion": "1:18.12.1-1.amzn2023.0.2",
      "fix": "ALAS2023-2023-084",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-084",
      "released": "2023-02-17T20:47:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:18.12.1-1.amzn2023.0.2",
      "fix": "ALAS2023-2023-084",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-084",
      "released": "2023-02-17T20:47:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "1:18.12.1-1.amzn2023.0.2",
      "fix": "ALAS2023-2023-084",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-084",
      "released": "2023-02-17T20:47:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs-devel",
      "release": "amzn 2023",
      "fixedVersion": "1:18.12.1-1.amzn2023.0.2",
      "fix": "ALAS2023-2023-084",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-084",
      "released": "2023-02-17T20:47:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs-docs",
      "release": "amzn 2023",
      "fixedVersion": "1:18.12.1-1.amzn2023.0.2",
      "fix": "ALAS2023-2023-084",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-084",
      "released": "2023-02-17T20:47:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs-full-i18n",
      "release": "amzn 2023",
      "fixedVersion": "1:18.12.1-1.amzn2023.0.2",
      "fix": "ALAS2023-2023-084",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-084",
      "released": "2023-02-17T20:47:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs-libs",
      "release": "amzn 2023",
      "fixedVersion": "1:18.12.1-1.amzn2023.0.2",
      "fix": "ALAS2023-2023-084",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-084",
      "released": "2023-02-17T20:47:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs-libs-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:18.12.1-1.amzn2023.0.2",
      "fix": "ALAS2023-2023-084",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-084",
      "released": "2023-02-17T20:47:00Z"
    },
    {
      "platform": "linux",
      "product": "npm",
      "release": "amzn 2023",
      "fixedVersion": "1:8.19.2-1.18.12.1.1.amzn2023.0.2",
      "fix": "ALAS2023-2023-084",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-084",
      "released": "2023-02-17T20:47:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "3.0.7-1",
      "fix": "DEBIAN-CVE-2022-3786",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-3786",
      "released": "2022-11-01T18:15:11Z"
    },
    {
      "platform": "linux",
      "product": "openssl",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "3.0.7-1",
      "fix": "DEBIAN-CVE-2022-3786",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-3786",
      "released": "2022-11-01T18:15:11Z"
    },
    {
      "platform": "linux",
      "product": "openssl",
      "release": "Debian 14",
      "fixedVersion": "3.0.7-1",
      "fix": "DEBIAN-CVE-2022-3786",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-3786",
      "released": "2022-11-01T18:15:11Z"
    },
    {
      "platform": "linux",
      "product": "openssl",
      "release": "RHEL 9",
      "fixedVersion": "1:3.0.1-43.el9_0",
      "fix": "RHSA-2022:7288",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7288",
      "released": "2022-11-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "3.0.2-0ubuntu1.7",
      "fix": "openssl 3.0.2-0ubuntu1.7",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-openssl-3.0.2-0ubuntu1.7",
      "released": "2022-10-31T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "3.0.5-2ubuntu2",
      "fix": "openssl 3.0.5-2ubuntu2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-openssl-3.0.5-2ubuntu2",
      "released": "2022-11-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl",
      "release": "Ubuntu 25.04 (plucky)",
      "fixedVersion": "3.0.5-2ubuntu2",
      "fix": "openssl 3.0.5-2ubuntu2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-openssl-3.0.5-2ubuntu2",
      "released": "2022-11-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl",
      "release": "almalinux 9",
      "fixedVersion": "1:3.0.1-43.el9_0",
      "fix": "ALSA-2022:7288",
      "url": "https://patchblox.com/security/fix/linux/alsa-2022-7288",
      "released": "2022-11-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl",
      "release": "amzn 2023",
      "fixedVersion": "1:3.0.5-1.amzn2023.0.4",
      "fix": "ALAS2023-2023-051",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-051",
      "released": "2023-02-17T20:45:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl",
      "release": "ol 9",
      "fixedVersion": "1:3.0.1-43.0.1.el9_0",
      "fix": "ELSA-2022-7288",
      "url": "https://patchblox.com/security/fix/linux/elsa-2022-7288",
      "released": "2022-11-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl",
      "release": "rocky 9",
      "fixedVersion": "1:3.0.1-43.el9_0",
      "fix": "RLSA-2022:7288",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2022-7288",
      "released": "2022-11-01T18:25:07Z"
    },
    {
      "platform": "linux",
      "product": "openssl-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:3.0.5-1.amzn2023.0.4",
      "fix": "ALAS2023-2023-051",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-051",
      "released": "2023-02-17T20:45:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "1:3.0.5-1.amzn2023.0.4",
      "fix": "ALAS2023-2023-051",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-051",
      "released": "2023-02-17T20:45:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl-devel",
      "release": "RHEL 9",
      "fixedVersion": "1:3.0.1-43.el9_0",
      "fix": "RHSA-2022:7288",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7288",
      "released": "2022-11-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl-devel",
      "release": "almalinux 9",
      "fixedVersion": "1:3.0.1-43.el9_0",
      "fix": "ALSA-2022:7288",
      "url": "https://patchblox.com/security/fix/linux/alsa-2022-7288",
      "released": "2022-11-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl-devel",
      "release": "amzn 2023",
      "fixedVersion": "1:3.0.5-1.amzn2023.0.4",
      "fix": "ALAS2023-2023-051",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-051",
      "released": "2023-02-17T20:45:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl-devel",
      "release": "ol 9",
      "fixedVersion": "1:3.0.1-43.0.1.el9_0",
      "fix": "ELSA-2022-7288",
      "url": "https://patchblox.com/security/fix/linux/elsa-2022-7288",
      "released": "2022-11-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl-libs",
      "release": "RHEL 9",
      "fixedVersion": "1:3.0.1-43.el9_0",
      "fix": "RHSA-2022:7288",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7288",
      "released": "2022-11-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl-libs",
      "release": "almalinux 9",
      "fixedVersion": "1:3.0.1-43.el9_0",
      "fix": "ALSA-2022:7288",
      "url": "https://patchblox.com/security/fix/linux/alsa-2022-7288",
      "released": "2022-11-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl-libs",
      "release": "amzn 2023",
      "fixedVersion": "1:3.0.5-1.amzn2023.0.4",
      "fix": "ALAS2023-2023-051",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-051",
      "released": "2023-02-17T20:45:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl-libs",
      "release": "ol 9",
      "fixedVersion": "1:3.0.1-43.0.1.el9_0",
      "fix": "ELSA-2022-7288",
      "url": "https://patchblox.com/security/fix/linux/elsa-2022-7288",
      "released": "2022-11-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl-libs-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:3.0.5-1.amzn2023.0.4",
      "fix": "ALAS2023-2023-051",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-051",
      "released": "2023-02-17T20:45:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl-perl",
      "release": "RHEL 9",
      "fixedVersion": "1:3.0.1-43.el9_0",
      "fix": "RHSA-2022:7288",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2022-7288",
      "released": "2022-11-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl-perl",
      "release": "almalinux 9",
      "fixedVersion": "1:3.0.1-43.el9_0",
      "fix": "ALSA-2022:7288",
      "url": "https://patchblox.com/security/fix/linux/alsa-2022-7288",
      "released": "2022-11-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl-perl",
      "release": "amzn 2023",
      "fixedVersion": "1:3.0.5-1.amzn2023.0.4",
      "fix": "ALAS2023-2023-051",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-051",
      "released": "2023-02-17T20:45:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl-perl",
      "release": "ol 9",
      "fixedVersion": "1:3.0.1-43.0.1.el9_0",
      "fix": "ELSA-2022-7288",
      "url": "https://patchblox.com/security/fix/linux/elsa-2022-7288",
      "released": "2022-11-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "v8-devel",
      "release": "amzn 2023",
      "fixedVersion": "2:10.2.154.15-1.18.12.1.1.amzn2023.0.2",
      "fix": "ALAS2023-2023-084",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-084",
      "released": "2023-02-17T20:47:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}