CVE-2022-3358 : Security Advisory and Response

This CVE-2022-3358 article provides insights into the vulnerability associated with using a custom cipher with NID_undef that may lead to NULL encryption in OpenSSL versions 3.0.0 to 3.0.5.

Understanding CVE-2022-3358

This section delves into the details of the CVE-2022-3358 vulnerability affecting OpenSSL.

What is CVE-2022-3358?

OpenSSL versions 3.0.0 to 3.0.5 mishandle legacy custom ciphers when passed to certain encryption and decryption functions, resulting in potential NULL encryption. The issue arises when applications incorrectly use NID_undef with EVP_CIPHER_meth_new(), causing plaintext to be emitted as ciphertext.

The Impact of CVE-2022-3358

Applications that call EVP_CIPHER_meth_new() with NID_undef and subsequently use it in encryption/decryption initialization functions may be affected. This issue does not impact applications that only use SSL/TLS and has been addressed in OpenSSL 3.0.6.

Technical Details of CVE-2022-3358

Explore the technical aspects related to CVE-2022-3358 to understand the vulnerability better.

Vulnerability Description

The vulnerability stems from OpenSSL's mishandling of legacy custom ciphers passed to specific encryption and decryption functions, resulting in the emission of plaintext as ciphertext when NID_undef is mistakenly used.

Affected Systems and Versions

OpenSSL versions 3.0.0 to 3.0.5 are impacted by this vulnerability, while OpenSSL 3.0.6 contains the necessary fixes to address the issue.

Exploitation Mechanism

The vulnerability is exploited when applications erroneously utilize NID_undef with EVP_CIPHER_meth_new(), triggering the fetching of the NULL cipher instead of the intended custom cipher, leading to NULL encryption.

Mitigation and Prevention

Discover the steps to mitigate and prevent exploitation of CVE-2022-3358 and secure your systems.

Immediate Steps to Take

Ensure OpenSSL is updated to version 3.0.6 to patch the vulnerability and prevent NULL encryption. Exercise caution when using custom ciphers with encryption/decryption functions to avoid potential security risks.

Long-Term Security Practices

Adopt secure coding practices by following OpenSSL's recommendations and guidelines for implementing custom ciphers. Regularly update OpenSSL to the latest versions to leverage security enhancements and bug fixes.

Patching and Updates

Stay informed about security advisories and patches released by OpenSSL to address vulnerabilities promptly. Timely updates and patches are critical in maintaining the security of your systems.