Openssl vulnerability october 2022 update#

November 1, 2022, 03:59 UTC - A previous version of this post noted that the OpenSSL Project evaluated one of the vulnerabilities as “Critical”.November 4, 2022, 23:36 UTC - Updated to reflect new OAG version available.December 1, 2022, 01:37 UTC - updated to reflect patches and mitigations have been applied.Update: OAG version 2022.11.0 is now available with an updated version of OpenSSL 3.0.7. Okta has assessed that Version 2022.10.0 of the Okta Access Gateway uses an impacted version of OpenSSL. OpenSSL 1.1.1 and 1.0.2 are not affected.OpenSSL 3.0 users should upgrade to OpenSSL 3.0.7.OpenSSL versions 3.0.0 to 3.0.6 are vulnerable.The OpenSSL project team announced last week that they will be releasing OpenSSL version 3.0.7, with a patch to fix a critical security vulnerability. Tomorrow is patch Tuesday and it’s a notable one. Customer Guidanceįor both CVEs, the severity level has been listed as “high” and the following information has been made available: Undisclosed OpenSSL vulnerability: Free scripts for target scoping. Security researchers Polar Bear and Viktor Dukhovni have been credited with reporting CVE-2022-3602 and CVE-2022-3786 on October 17 and 18, 2022. Okta’s engineering teams have applied patches and other mitigations, where required. While CVE-2022-3602 was initially treated as a Critical vulnerability, its severity has since been downgraded to High, citing stack overflow protections in modern platforms.

Openssl vulnerability october 2022 update#

The OpenSSL Project has announced the availability of a security update (version 3.07) that addresses a vulnerability affecting OpenSSL versions 3.0 and above (3.0.0 - 3.0.6).