CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2022-2274

CVSS 9.8v3.1pub. 2022-07-01upd. 2024-11-21

The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a consequence of the memory corruption an attacker may be able to trigger a remote code execution on the machine performing the computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Netapp H300s

    HW
    Netapp
    all versions

  • Netapp H300s Firmware

    OS
    Netapp
    all versions

  • Netapp H410c

    HW
    Netapp
    all versions

  • Netapp H410c Firmware

    OS
    Netapp
    all versions

  • Netapp H410s

    HW
    Netapp
    all versions

  • Netapp H410s Firmware

    OS
    Netapp
    all versions

  • Netapp H500s

    HW
    Netapp
    all versions

  • Netapp H500s Firmware

    OS
    Netapp
    all versions

  • Netapp H700s

    HW
    Netapp
    all versions

  • Netapp H700s Firmware

    OS
    Netapp
    all versions

  • Netapp Snapcenter

    APP
    Netapp
    all versions

  • OpenSSL

    APP
    Openssl
    3.0.4
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2024-54085CRITICAL10.0⚠ KEVPL ✓same product

AMI MegaRAC SPx — zdalne ominięcie uwierzytelnienia w interfejsie Redfish BMC

CVE-2021-44228CRITICAL10.0⚠ KEVPL ✓same product

Apache Log4j2 Log4Shell — RCE przez podatną funkcję JNDI lookup

CVE-2026-34182CRITICAL9.1PL ✓same product

OpenSSL CMS AuthEnvelopedData — niewystarczająca walidacja wejścia umożliwia atak oracle i bypass integralnośc...

CVE-2026-31789CRITICAL9.8PL ✓same product

OpenSSL: heap buffer overflow przy konwersji OCTET STRING na hex (32-bit)

CVE-2025-26512CRITICAL9.9PL ✓same product

NetApp SnapCenter — eskalacja uprawnień do administratora systemu zdalnego