A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.\' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.
Find out more about CVE-2022-3786 from the MITRE-CVE dictionary and NIST NVD
Login may be required to access defects or downloads.
| Product Name | Status | Defect | Fixed | Downloads |
|---|---|---|---|---|
| Linux | ||||
| Wind River Linux LTS 17 | Not Vulnerable | -- | -- |
Wind River Security Vulnerability Notice: CVE-2022-3602 CVE-2022-3786 |
| Wind River Linux 8 | Requires LTSS | -- | -- |
Wind River Security Vulnerability Notice: CVE-2022-3602 CVE-2022-3786 |
| Wind River Linux 9 | Requires LTSS | -- | -- |
Wind River Security Vulnerability Notice: CVE-2022-3602 CVE-2022-3786 |
| Wind River Linux 7 | Requires LTSS | -- | -- |
Wind River Security Vulnerability Notice: CVE-2022-3602 CVE-2022-3786 |
| Wind River Linux LTS 21 | Not Vulnerable | -- | -- |
Wind River Security Vulnerability Notice: CVE-2022-3602 CVE-2022-3786 |
| Wind River Linux LTS 22 | Fixed |
LIN1022-2294 |
10.22.33.2 |
Wind River Security Vulnerability Notice: CVE-2022-3602 CVE-2022-3786 |
| Wind River Linux LTS 18 | Not Vulnerable | -- | -- |
Wind River Security Vulnerability Notice: CVE-2022-3602 CVE-2022-3786 |
| Wind River Linux LTS 19 | Not Vulnerable | -- | -- |
Wind River Security Vulnerability Notice: CVE-2022-3602 CVE-2022-3786 |
| Wind River Linux CD release | Fixed |
LINCD-10733 |
10.22.45.0 |
Wind River Security Vulnerability Notice: CVE-2022-3602 CVE-2022-3786 |
| Wind River Linux 6 | Requires LTSS | -- | -- | -- |
| Wind River Linux LTS 23 | Not Vulnerable | -- | -- | -- |
| VxWorks | ||||
| VxWorks 7 | Fixed | -- | 23.03 | -- |
| VxWorks 6.9 | Not Vulnerable | -- | -- | -- |
| Helix Virtualization Platform Cert Edition | ||||
| Helix Virtualization Platform Cert Edition | Not Vulnerable | -- | -- | -- |
| Product Name | Status | Defect | Fixed | Downloads |
|---|
