# MA-883.112022: MyCERT Advisory - OpenSSL Releases Security Update

**Date:** 02 Nov 2022  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-883.112022  
**Advisory ID:** MA-883.112022

---

**1.0 Introduction**
Recently, OpenSSL has released a security advisory to address two vulnerabilities, CVE-2022-3602 and CVE-2022-3786, affecting OpenSSL versions 3.0.0 through 3.0.6.
**2.0 Impact**
Both CVE-2022-3602 and CVE-2022-3786 can cause a denial of service. According to OpenSSL, a cyber threat actor leveraging CVE-2022-3786, "can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution," allowing them to take control of an affected system.
**3.0 Affected Products**
OpenSSL versions 3.0.0 to 3.0.6 are vulnerable to this issue.
**4.0 Recommendations**
MyCERT encourages users and administrators to review the OpenSSL [advisory](https://www.openssl.org/news/secadv/20221101.txt), [blog](https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/), [OpenSSL 3.0.7 announcement](https://mta.openssl.org/pipermail/openssl-announce/2022-November/000241.html), and upgrade to OpenSSL 3.0.7. For additional information on affected products, see the [2022 OpenSSL vulnerability - CVE-2022-3602 GitHub repository](https://github.com/NCSC-NL/OpenSSL-2022/blob/main/software/README.md), jointly maintained by the Netherland's National Cyber Security Centrum (NCSC-NL) and CISA.
Generally, MyCERT advises the users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
<https://www.cisa.gov/uscert/ncNetherlands'as/current-activity/2022/11/01/openssl-releases-security-update>
<https://www.openssl.org/news/secadv/20221101.txt>