CVE-2022-4450 is a high-severity vulnerability affecting certain versions of OpenSSL and Stormshield Network Security software. The issue lies in the PEM\_read\_bio\_ex() function, which could lead to a double-free scenario and potentially cause a denial of service attack. Systems running vulnerable versions of these software packages are at risk, and users are advised to update to the latest, secure versions to mitigate the threat.

How do I know if I'm affected?

If you're using OpenSSL or Stormshield Network Security software, you might be affected by the CVE-2022-4450 vulnerability. The affected OpenSSL versions are 1.1.1 to 1.1.1t and 3.0.0 to 3.0.8. For Stormshield Network Security, versions 4.0.0 to 4.3.16 and 4.4.0 to 4.6.3 are impacted. To determine if you're affected, check the versions of OpenSSL or Stormshield Network Security you're using and compare them to the vulnerable versions mentioned.

What should I do if I'm affected?

If you're affected by the CVE-2022-4450 vulnerability, it's crucial to update your OpenSSL or Stormshield Network Security software to the latest secure version. For OpenSSL, upgrade to 3.0.10 or 1.1.1t, depending on your current version. For Stormshield, follow their update guidelines. Upgrading will help protect your system from potential denial of service attacks caused by this vulnerability.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2022-4450 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. To address this vulnerability, users should update their OpenSSL software to the latest secure version, as recommended by the OpenSSL Security Advisory.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-415 section discusses a double-free issue in OpenSSL's PEM\_read\_bio\_ex() function, which could lead to a denial of service.

For more details

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD or the resources listed below.

• git.openssl.org Commit Diff

• git.openssl.org Commit Page

• Gentoo Security Advisory

• OpenSSL Security Advisory