OpenSSL Releases Patch for Excessive-Severity Bug that May Result in RCE Assaults

The maintainers of the OpenSSL mission have launched patches to handle a high-severity bug within the cryptographic library that would probably result in distant code execution below sure situations.

The situation, now assigned the identifier CVE-2022-2274, has been described as a case of heap reminiscence corruption with RSA personal key operation that was launched in OpenSSL model 3.0.4 launched on June 21, 2022.

First launched in 1998, OpenSSL is a general-purpose cryptography library that gives open-source implementation of the Safe Sockets Layer (SSL) and Transport Layer Safety (TLS) protocols, enabling customers to generate personal keys, create certificates signing requests (CSRs), set up SSL/TLS certificates.


“SSL/TLS servers or different servers utilizing 2048 bit RSA personal keys operating on machines supporting AVX512IFMA directions of the X86_64 structure are affected by this situation,” the advisory famous.

Calling it a “critical bug within the RSA implementation,” the maintainers mentioned the flaw may result in reminiscence corruption throughout computation that might be weaponized by an attacker to set off distant code execution on the machine performing the computation.

Xi Ruoyao, a Ph.D. pupil at Xidian College, has been credited with reporting the flaw to OpenSSL on June 22, 2022. Customers of the library are really useful to improve to OpenSSL model 3.0.5 to mitigate any potential threats.

Leave a Reply