NewsSiemens ProductCERT
SSA-408105 V1.0: Buffer Overflow Vulnerabilities in OpenSSL 3.0 Affecting Siemens Products
Linked advisories
- CVE-2022-3786X.509 Email Address Variable Length Buffer Overflow
- CVE-2022-3786X.509 Email Address Variable Length Buffer Overflow
- CVE-2022-3786OpenSSL: Pufferüberlauf
- CVE-2022-3602Siemens ProductCERT Advisory SSA-408105
- CVE-2022-3602OpenSSL vulnerabilities
- CVE-2022-3602X.509 Email Address 4-byte Buffer Overflow
- CVE-2022-3602High Severity Vulnerabilities in OpenSSL
- CVE-2022-3602X.509 Email Address 4-byte Buffer Overflow
- CVE-2022-3786OpenSSL: Pufferüberlauf
- CVE-2022-3602X.509 Email Address 4-byte Buffer Overflow
- CVE-2022-3602OpenSSL: Pufferüberlauf
- CVE-2022-3602X.509 Email Address 4-byte Buffer Overflow
- CVE-2022-3786X.509 Email Address Variable Length Buffer Overflow
- CVE-2022-3786X.509 Email Address Variable Length Buffer Overflow
- CVE-2022-3602OpenSSL: Pufferüberlauf
Affected vendors and products
More on OpenSSL
Other advisories
- HighCVE-2026-42768OpenSSL: Mehrere Schwachstellen
- MediumCVE-2026-84782OpenSSL: Mehrere Schwachstellen
- HighCVE-2025-15469OpenSSL: Mehrere Schwachstellen
- HighCVE-2026-28387OpenSSL: Mehrere Schwachstellen
- Not ratedosv:ROOT-APP-PYPI-CVE-2026-27459CVE-2026-27459 in pyOpenSSL - Patched by Root
- Not ratedosv:SUSE-RU-2026:5018-1Recommended update for openssl-3
- Not ratedosv:ECHO-f62c-6c16-552eGHSA-p85m-gvr3-788c: hostname verification skipped on the OpenSSL client path with a plain X509TrustManager when trust-manager wrapping is unavailable (Java 25+). Upstream's fix (in https://github.com/netty/netty/commit/9e05192391, 4.1.137.Final) only adds a check at context creation for an endpoint identification algorithm set with SslContextBuilder.endpointIdentificationAlgorithm(...), which netty added in 4.1.112.Final (0deca94aa1); 4.1.74.Final has no such setting. The other way to ask for hostname verification, SSLParameters on the engine, is the same in 4.1.74.Final and in fixed 4.1.137.Final (it sets SSL_CVERIFY_REQUIRED and leaves the check to the trust manager), and the fix does not change it. CVE-2026-50010, patched above, covers wrapping plain trust managers.
- Not ratedosv:CLEANSTART-2025-ZT05905OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack
Other news entries
- GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session DecryptionNewsThe Hacker News
- OpenSSL: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- OpenSSL: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- OpenSSL Fixes High-Severity DTLS Flaw That Can Leak Heap Memory UnencryptedNewsThe Hacker News
- High-Severity Vulnerabilities Patched in OpenSSL, WolfSSLNewsSecurityWeek
- Multiples vulnérabilités dans OpenSSL (30 septembre 2026)NewsCERT-FR (ANSSI)
- OpenSSL: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenVulnerabilityBSI CERT-Bund
- OpenSSL: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenVulnerabilityBSI CERT-Bund
Source: https://cert-portal.siemens.com/productcert/pdf/ssa-408105.pdf
ID