CVE-2022-3786, CVE-2022-3602: OpenSSL High Severity Vulnerabilities

Update 11/2: A link to an additional knowledge base article has been added to this community post.

On November 1, OpenSSL published patches for OpenSSL versions 3.0.0 through 3.0.6 to address two high-severity vulnerabilities.

• CVE-2022-3786
• CVE-2022-3602

Originally, OpenSSL stated that one of these two flaws was rated critical. However, during its prenotification process, it determined that exploitation was mitigated in certain implementations, and it revised its original severity down to high.

Update: On November 2, we published a knowledge base article, Official Tenable information regarding CVE-2022-3786 & CVE-2022-3602 in OpenSSL. Please refer to this article for official information about any impact to Tenable products.

For more information about these vulnerabilities, including the availability of patches and Tenable product coverage, please visit our blog.