<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">Hey Kurt,<br>
<br>
Thank you for the quick and informative response! I think I saw the c_rehash exploitation and mistook CVE-2022-1292 for CVE-2022-2068. I agree if it is not exploitable over the network a 9.8 is frankly ridiculous as the CVSS3.1 shows the CVE is network exploitable
(AV:N) . I just saw the vulnerable version in the original CVE <a href="https://nvd.nist.gov/vuln/detail/CVE-2022-1292" title="https://nvd.nist.gov/vuln/detail/CVE-2022-1292"><span style="color:#000068">https://nvd.nist.gov/vuln/detail/CVE-2022-1292</span></a> and
that we are still on 1.1.1n and assumed it was vulnerable since it matched the vulnerable version number in the CPE specifications. It seems the answer was in front of me! <br>
<br>
So in regard to CVE-2022-2068 I see now that there are fixes for each release in the security repos. <br>
<br>
Thanks a bunch,</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">Chilly</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">Kurt Roeckx <kurt@roeckx.be><br>
<b>Date: </b>Thursday, June 23, 2022 at 13:16<br>
<b>To: </b>chilly <chilly@cylitic.com><br>
<b>Cc: </b>pkg-openssl-devel@lists.alioth.debian.org <pkg-openssl-devel@lists.alioth.debian.org><br>
<b>Subject: </b>EXTERNAL: Re: [Pkg-openssl-devel] Patch for critical CVE in OpenSSL<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:11.0pt">On Thu, Jun 23, 2022 at 04:45:23PM +0000, chilly wrote:<br>
> Hello everyone!<br>
> <br>
> First time messaging this mailing list but at the moment there is a pretty nasty CVE for OpenSSL
<a href="https://nvd.nist.gov/vuln/detail/CVE-2022-1292">https://nvd.nist.gov/vuln/detail/CVE-2022-1292</a>. It’s a 9.8/10 command execution and has already been patched (since 1.1.1p for stable). Looking at
<a href="https://security-tracker.debian.org/tracker/source-package/openssl">https://security-tracker.debian.org/tracker/source-package/openssl</a> I see that the patch hasn’t deployed yet and I just wanted to bring that to everyone’s attention. If anyone needs
help maintaining the package please let me know!<br>
<br>
If you look at the security-tracker page you've linked to, you'll see it<br>
in the resolved issues section. If you go to<br>
<a href="https://security-tracker.debian.org/tracker/CVE-2022-1292">https://security-tracker.debian.org/tracker/CVE-2022-1292</a> you'll see<br>
that it's fixed in all suites.<br>
<br>
The 9.8/10 is really just plain wrong, it's not exploitable over the<br>
network.<br>
<br>
There is also CVE-2022-2068, which is very simular, and hasn't been<br>
fixed in all suites yet. It's unlikely that this will actually<br>
affect you.<br>
<br>
<br>
Kurt<o:p></o:p></span></p>
</div>
</div>
</body>
</html>