緩衝區溢位可以在 X.509 證書驗證中觸發，特別是在名稱約束檢查中。

請注意，這發生在證書鏈簽名驗證之後，並且要求 CA 已對惡意證書進行簽名，或者要求應用程式繼續證書驗證，儘管無法構造指向受信任頒發者的路徑。
攻擊者可以手工建立惡意電子郵件地址，使堆疊上四個攻擊者控制的位元組溢位。此緩衝區溢位可能導致崩潰（導致拒絕服務）或可能遠端執行程式碼。許多平臺都實現了堆疊溢位保護，以降低遠端程式碼執行的風險。根據任何給定平臺/編譯器的堆疊佈局，可以進一步降低風險。

CVE-2022-3602 的預公告將此問題描述為「嚴重」。基於上述一些緩解因素的進一步分析導致其降級為HIGH。我們仍鼓勵使用者儘快升級到新版本。

在 TLS 使用者端中，可以通過連線到惡意伺服器來觸發此操作。

在 TLS 伺服器中，如果伺服器請求使用者端身份驗證並且惡意使用者端連線，則可以觸發此操作。

在 OpenSSL 3.0.7 中修復（受影響的 3.0.0、3.0.1、3.0.2、3.0.3、3.0.4、3.0.5、3.0.6）。

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking.

Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer.
An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler.

Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible.

In a TLS client, this can be triggered by connecting to a malicious server.

In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.

Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6).

緩衝區溢位可以在 X.509 證書驗證中觸發，特別是在名稱約束檢查中。
請注意，這發生在證書鏈簽名驗證之後，並且要求 CA 已簽署惡意證書或應用程式繼續證書驗證，儘管無法構造到受信任頒發者的路徑。
攻擊者可以在證書中構建惡意電子郵件地址，以溢位堆疊上包含「.」字元（十進位制 46）的任意數量的位元組。此緩衝區溢位可能導致崩潰（導致拒絕服務）。

在 TLS 使用者端中，可以通過連線到惡意伺服器來觸發此操作。

在 TLS 伺服器中，如果伺服器請求使用者端身份驗證並且惡意使用者端連線，則可以觸發此操作。

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking.
Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer.

An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service).

In a TLS client, this can be triggered by connecting to a malicious server.

In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.