{"id":15968,"date":"2022-11-02T07:38:28","date_gmt":"2022-11-02T11:38:28","guid":{"rendered":"https:\/\/newsite.inuvika.com\/?p=15968"},"modified":"2023-01-20T10:00:45","modified_gmt":"2023-01-20T14:00:45","slug":"cvd-2022-3602-vulnerabilite-dopenssl","status":"publish","type":"post","link":"https:\/\/www.inuvika.com\/fr\/cvd-2022-3602-openssl-vulnerability\/","title":{"rendered":"Avis : CVE-2022-3786 et CVE-2022-3602 : D\u00e9bordements de la m\u00e9moire tampon de l'adresse \u00e9lectronique X.509 OpenSSL"},"content":{"rendered":"

Mise \u00e0 jour Inuvika concernant CVE-2022-3786 et CVE-2022-3602 : X.509 (OpenSSL Email Address Buffer Overflows)<\/p>\n

Vue d'ensemble<\/h2>\n

Les versions concern\u00e9es du paquetage OpenSSL sont vuln\u00e9rables \u00e0 un d\u00e9bordement de m\u00e9moire tampon. Un d\u00e9passement de tampon peut \u00eatre d\u00e9clench\u00e9 lors de la v\u00e9rification des certificats X.509, en particulier lors de la v\u00e9rification des contraintes de nom. Notez que cela se produit apr\u00e8s la v\u00e9rification de la signature de la cha\u00eene de certificats et n\u00e9cessite qu'une autorit\u00e9 de certification ait sign\u00e9 le certificat malveillant ou que l'application poursuive la v\u00e9rification du certificat malgr\u00e9 l'\u00e9chec de la construction d'un chemin vers un \u00e9metteur de confiance. Un attaquant peut cr\u00e9er une adresse \u00e9lectronique malveillante pour d\u00e9border quatre octets contr\u00f4l\u00e9s par l'attaquant sur la pile. Ce d\u00e9passement de m\u00e9moire tampon peut entra\u00eener un plantage (provoquant un d\u00e9ni de service) ou potentiellement l'ex\u00e9cution de code \u00e0 distance.<\/p>\n

Dans un client TLS, ce ph\u00e9nom\u00e8ne peut \u00eatre d\u00e9clench\u00e9 par la connexion \u00e0 un serveur malveillant.<\/em><\/p>\n

Dans un serveur TLS, cela peut \u00eatre d\u00e9clench\u00e9 si le serveur demande l'authentification du client et qu'un client malveillant se connecte.<\/em><\/p>\n

Note : Les annonces pr\u00e9alables de CVE-2022-3602 d\u00e9crivaient ce probl\u00e8me comme \u00e9tant CRITIQUE. Une analyse plus approfondie bas\u00e9e sur certains des facteurs d'att\u00e9nuation d\u00e9crits ci-dessus a conduit \u00e0 la r\u00e9trogradation de ce probl\u00e8me au niveau HAUT. Les utilisateurs sont toujours encourag\u00e9s \u00e0 passer \u00e0 une nouvelle version d\u00e8s que possible.<\/p>\n

Impact sur l'entreprise OVD<\/h2>\n

Les probl\u00e8mes identifi\u00e9s n'ont pas d'impact direct sur les composants du service OVD Enterprise. Cependant, il est conseill\u00e9 aux clients de v\u00e9rifier la version d'OpenSSL install\u00e9e sur leurs serveurs Linux \u00e0 l'aide de la commande suivante (avec un exemple de sortie) :<\/p>\n

% version openssl<\/strong>
\nOpenSSL 3.0.5 5 Jul 2022 (Biblioth\u00e8que : OpenSSL 3.0.5 5 Jul 2022)<\/strong><\/p>\n

Cette vuln\u00e9rabilit\u00e9 n'affecte que OpenSSL 3.0.x et non 1.1.1.<\/p>\n

Inuvika continue d'examiner la situation et informera ses clients de tout impact direct sur les produits et services d'Inuvika.<\/p>\n

Recommandation actuelle pour les clients d'OVD Enterprise<\/h2>\n

Inuvika recommande \u00e0 ses clients de suivre les meilleures pratiques informatiques et d'effectuer les mises \u00e0 jour de maintenance recommand\u00e9es par le fournisseur au fur et \u00e0 mesure qu'elles sont publi\u00e9es.<\/p>\n

Il est conseill\u00e9 aux clients qui utilisent une version 3.0.x d'OpenSSL affect\u00e9e de mettre \u00e0 jour vers OpenSSL 3.0.7 d\u00e8s que possible.<\/p>\n

Apr\u00e8s l'application d'un correctif, v\u00e9rifiez que le composant fonctionne comme pr\u00e9vu.<\/p>\n

Ressources<\/h2>\n

OpenSSL a publi\u00e9 la version 3.0.7 le 1er novembre 2022 : https:\/\/www.openssl.org\/blog\/blog\/2022\/11\/01\/email-address-overflows\/<\/a><\/p>\n

SANS Internet Storm Center : a Liste des distributions Linux concern\u00e9es<\/a>
\nDistroWatch : a Liste des distributions Linux concern\u00e9es<\/a><\/p>\n

Inuvika Ressources de soutien<\/a><\/p>\n

Dans l'actualit\u00e9<\/h2>\n

Avis d'OpenSSL<\/a>
\nListe de diffusion OpenSSL<\/a><\/p>\n

 <\/p>","protected":false},"excerpt":{"rendered":"

Inuvika Update Regarding CVE-2022-3786 and CVE-2022-3602: X.509 (OpenSSL Email Address Buffer Overflows) Overview Affected versions of the OpenSSL package are vulnerable to Buffer Overflow. A buffer overrun can be triggered […]<\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[176,67,66],"tags":[70,79],"class_list":["post-15968","post","type-post","status-publish","format-standard","hentry","category-all-posts","category-ovd-enterprise","category-support","tag-announcements","tag-security"],"blocksy_meta":[],"yoast_head":"\nInuvika - Advisory: CVE-2022-3786 and CVE-2022-3602 OpenSSL Vulnerabilities<\/title>\n<meta name=\"description\" content=\"CVE-2022-3786 \/ CVE-2022-3602 security vulnerabilities have been identified that impact multiple versions of OpenSSL 3.0.x\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.inuvika.com\/fr\/cvd-2022-3602-vulnerabilite-dopenssl\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Inuvika - Advisory: CVE-2022-3786 and CVE-2022-3602 OpenSSL Vulnerabilities\" \/>\n<meta property=\"og:description\" content=\"CVE-2022-3786 \/ CVE-2022-3602 security vulnerabilities have been identified that impact multiple versions of OpenSSL 3.0.x\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.inuvika.com\/fr\/cvd-2022-3602-vulnerabilite-dopenssl\/\" \/>\n<meta property=\"og:site_name\" content=\"Inuvika\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/inuvika\/\" \/>\n<meta property=\"article:published_time\" content=\"2022-11-02T11:38:28+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-01-20T14:00:45+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.inuvika.com\/wp-content\/uploads\/2018\/10\/inuvika-logo.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"718\" \/>\n\t<meta property=\"og:image:height\" content=\"169\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Alex Perkins\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@InuvikaInc\" \/>\n<meta name=\"twitter:site\" content=\"@InuvikaInc\" \/>\n<meta name=\"twitter:label1\" content=\"\u00c9crit par\" \/>\n\t<meta name=\"twitter:data1\" content=\"\" \/>\n\t<meta name=\"twitter:label2\" content=\"Dur\u00e9e de lecture estim\u00e9e\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.inuvika.com\\\/cvd-2022-3602-openssl-vulnerability\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.inuvika.com\\\/cvd-2022-3602-openssl-vulnerability\\\/\"},\"author\":{\"name\":\"Alex Perkins\",\"@id\":\"https:\\\/\\\/www.inuvika.com\\\/#\\\/schema\\\/person\\\/234ef022f9d350b26d773e0434c339ef\"},\"headline\":\"Advisory: CVE-2022-3786 and CVE-2022-3602: X.509 OpenSSL Email Address Buffer Overflows\",\"datePublished\":\"2022-11-02T11:38:28+00:00\",\"dateModified\":\"2023-01-20T14:00:45+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.inuvika.com\\\/cvd-2022-3602-openssl-vulnerability\\\/\"},\"wordCount\":373,\"publisher\":{\"@id\":\"https:\\\/\\\/www.inuvika.com\\\/#organization\"},\"keywords\":[\"Announcements\",\"Security\"],\"articleSection\":[\"All Posts\",\"OVD Enterprise\",\"Support\"],\"inLanguage\":\"fr-FR\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.inuvika.com\\\/cvd-2022-3602-openssl-vulnerability\\\/\",\"url\":\"https:\\\/\\\/www.inuvika.com\\\/cvd-2022-3602-openssl-vulnerability\\\/\",\"name\":\"Inuvika - Advisory: CVE-2022-3786 and CVE-2022-3602 OpenSSL Vulnerabilities\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.inuvika.com\\\/#website\"},\"datePublished\":\"2022-11-02T11:38:28+00:00\",\"dateModified\":\"2023-01-20T14:00:45+00:00\",\"description\":\"CVE-2022-3786 \\\/ CVE-2022-3602 security vulnerabilities have been identified that impact multiple versions of OpenSSL 3.0.x\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.inuvika.com\\\/cvd-2022-3602-openssl-vulnerability\\\/#breadcrumb\"},\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.inuvika.com\\\/cvd-2022-3602-openssl-vulnerability\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.inuvika.com\\\/cvd-2022-3602-openssl-vulnerability\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.inuvika.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Advisory: CVE-2022-3786 and CVE-2022-3602: X.509 OpenSSL Email Address Buffer Overflows\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.inuvika.com\\\/#website\",\"url\":\"https:\\\/\\\/www.inuvika.com\\\/\",\"name\":\"inuvika.com\",\"description\":\"Apps + Desktops to any device!\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.inuvika.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.inuvika.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"fr-FR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.inuvika.com\\\/#organization\",\"name\":\"Inuvika Inc\",\"url\":\"https:\\\/\\\/www.inuvika.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/www.inuvika.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.inuvika.com\\\/wp-content\\\/uploads\\\/2018\\\/10\\\/inuvika-logo.png\",\"contentUrl\":\"https:\\\/\\\/www.inuvika.com\\\/wp-content\\\/uploads\\\/2018\\\/10\\\/inuvika-logo.png\",\"width\":718,\"height\":169,\"caption\":\"Inuvika Inc\"},\"image\":{\"@id\":\"https:\\\/\\\/www.inuvika.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/inuvika\\\/\",\"https:\\\/\\\/x.com\\\/InuvikaInc\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/inuvika-inc-\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UC4nWPydrDItH1KMWqfQw8aA\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.inuvika.com\\\/#\\\/schema\\\/person\\\/234ef022f9d350b26d773e0434c339ef\",\"name\":\"Alex Perkins\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/843e5a6422b327b27f867c0d1b416b7fc083d4f028d5d861a69cc5a92185d7e6?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/843e5a6422b327b27f867c0d1b416b7fc083d4f028d5d861a69cc5a92185d7e6?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/843e5a6422b327b27f867c0d1b416b7fc083d4f028d5d861a69cc5a92185d7e6?s=96&d=mm&r=g\",\"caption\":\"Alex Perkins\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Inuvika - Avis : Vuln\u00e9rabilit\u00e9s OpenSSL CVE-2022-3786 et CVE-2022-3602","description":"Les failles de s\u00e9curit\u00e9 CVE-2022-3786 \/ CVE-2022-3602 ont \u00e9t\u00e9 identifi\u00e9es et affectent plusieurs versions d'OpenSSL 3.0.x.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.inuvika.com\/fr\/cvd-2022-3602-vulnerabilite-dopenssl\/","og_locale":"fr_FR","og_type":"article","og_title":"Inuvika - Advisory: CVE-2022-3786 and CVE-2022-3602 OpenSSL Vulnerabilities","og_description":"CVE-2022-3786 \/ CVE-2022-3602 security vulnerabilities have been identified that impact multiple versions of OpenSSL 3.0.x","og_url":"https:\/\/www.inuvika.com\/fr\/cvd-2022-3602-vulnerabilite-dopenssl\/","og_site_name":"Inuvika","article_publisher":"https:\/\/www.facebook.com\/inuvika\/","article_published_time":"2022-11-02T11:38:28+00:00","article_modified_time":"2023-01-20T14:00:45+00:00","og_image":[{"width":718,"height":169,"url":"https:\/\/www.inuvika.com\/wp-content\/uploads\/2018\/10\/inuvika-logo.jpg","type":"image\/jpeg"}],"author":"Alex Perkins","twitter_card":"summary_large_image","twitter_creator":"@InuvikaInc","twitter_site":"@InuvikaInc","twitter_misc":{"\u00c9crit par":false,"Dur\u00e9e de lecture estim\u00e9e":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.inuvika.com\/cvd-2022-3602-openssl-vulnerability\/#article","isPartOf":{"@id":"https:\/\/www.inuvika.com\/cvd-2022-3602-openssl-vulnerability\/"},"author":{"name":"Alex Perkins","@id":"https:\/\/www.inuvika.com\/#\/schema\/person\/234ef022f9d350b26d773e0434c339ef"},"headline":"Advisory: CVE-2022-3786 and CVE-2022-3602: X.509 OpenSSL Email Address Buffer Overflows","datePublished":"2022-11-02T11:38:28+00:00","dateModified":"2023-01-20T14:00:45+00:00","mainEntityOfPage":{"@id":"https:\/\/www.inuvika.com\/cvd-2022-3602-openssl-vulnerability\/"},"wordCount":373,"publisher":{"@id":"https:\/\/www.inuvika.com\/#organization"},"keywords":["Announcements","Security"],"articleSection":["All Posts","OVD Enterprise","Support"],"inLanguage":"fr-FR"},{"@type":"WebPage","@id":"https:\/\/www.inuvika.com\/cvd-2022-3602-openssl-vulnerability\/","url":"https:\/\/www.inuvika.com\/cvd-2022-3602-openssl-vulnerability\/","name":"Inuvika - Avis : Vuln\u00e9rabilit\u00e9s OpenSSL CVE-2022-3786 et CVE-2022-3602","isPartOf":{"@id":"https:\/\/www.inuvika.com\/#website"},"datePublished":"2022-11-02T11:38:28+00:00","dateModified":"2023-01-20T14:00:45+00:00","description":"Les failles de s\u00e9curit\u00e9 CVE-2022-3786 \/ CVE-2022-3602 ont \u00e9t\u00e9 identifi\u00e9es et affectent plusieurs versions d'OpenSSL 3.0.x.","breadcrumb":{"@id":"https:\/\/www.inuvika.com\/cvd-2022-3602-openssl-vulnerability\/#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.inuvika.com\/cvd-2022-3602-openssl-vulnerability\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.inuvika.com\/cvd-2022-3602-openssl-vulnerability\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.inuvika.com\/"},{"@type":"ListItem","position":2,"name":"Advisory: CVE-2022-3786 and CVE-2022-3602: X.509 OpenSSL Email Address Buffer Overflows"}]},{"@type":"WebSite","@id":"https:\/\/www.inuvika.com\/#website","url":"https:\/\/www.inuvika.com\/","name":"inuvika.com","description":"Apps + Desktops sur n'importe quel appareil !","publisher":{"@id":"https:\/\/www.inuvika.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.inuvika.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"fr-FR"},{"@type":"Organization","@id":"https:\/\/www.inuvika.com\/#organization","name":"Inuvika Inc","url":"https:\/\/www.inuvika.com\/","logo":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/www.inuvika.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.inuvika.com\/wp-content\/uploads\/2018\/10\/inuvika-logo.png","contentUrl":"https:\/\/www.inuvika.com\/wp-content\/uploads\/2018\/10\/inuvika-logo.png","width":718,"height":169,"caption":"Inuvika Inc"},"image":{"@id":"https:\/\/www.inuvika.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/inuvika\/","https:\/\/x.com\/InuvikaInc","https:\/\/www.linkedin.com\/company\/inuvika-inc-\/","https:\/\/www.youtube.com\/channel\/UC4nWPydrDItH1KMWqfQw8aA"]},{"@type":"Person","@id":"https:\/\/www.inuvika.com\/#\/schema\/person\/234ef022f9d350b26d773e0434c339ef","name":"Alex Perkins","image":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/secure.gravatar.com\/avatar\/843e5a6422b327b27f867c0d1b416b7fc083d4f028d5d861a69cc5a92185d7e6?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/843e5a6422b327b27f867c0d1b416b7fc083d4f028d5d861a69cc5a92185d7e6?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/843e5a6422b327b27f867c0d1b416b7fc083d4f028d5d861a69cc5a92185d7e6?s=96&d=mm&r=g","caption":"Alex Perkins"}}]}},"brizy_media":[],"_links":{"self":[{"href":"https:\/\/www.inuvika.com\/fr\/wp-json\/wp\/v2\/posts\/15968","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.inuvika.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.inuvika.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.inuvika.com\/fr\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/www.inuvika.com\/fr\/wp-json\/wp\/v2\/comments?post=15968"}],"version-history":[{"count":0,"href":"https:\/\/www.inuvika.com\/fr\/wp-json\/wp\/v2\/posts\/15968\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.inuvika.com\/fr\/wp-json\/wp\/v2\/media?parent=15968"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.inuvika.com\/fr\/wp-json\/wp\/v2\/categories?post=15968"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.inuvika.com\/fr\/wp-json\/wp\/v2\/tags?post=15968"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}