diff --git a/advisories/github-reviewed/2022/12/GHSA-vr8j-hgmm-jh9r/GHSA-vr8j-hgmm-jh9r.json b/advisories/github-reviewed/2022/12/GHSA-vr8j-hgmm-jh9r/GHSA-vr8j-hgmm-jh9r.json index 906fc8d7e68..030d6aefc43 100644 --- a/advisories/github-reviewed/2022/12/GHSA-vr8j-hgmm-jh9r/GHSA-vr8j-hgmm-jh9r.json +++ b/advisories/github-reviewed/2022/12/GHSA-vr8j-hgmm-jh9r/GHSA-vr8j-hgmm-jh9r.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-vr8j-hgmm-jh9r", - "modified": "2024-08-02T16:01:26Z", + "modified": "2024-10-02T18:03:42Z", "published": "2022-12-13T18:30:33Z", "aliases": [ "CVE-2022-3996" ], - "summary": "openssl-src subject to DoS by double-checked locking", + "summary": "Denial of service by double-checked locking in openssl-src", "details": "If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy processing being enabled on a publicly facing server is not considered to be a common setup. Policy processing is enabled by passing the `-policy' argument to the command line utilities or by calling either `X509_VERIFY_PARAM_add0_policy()' or `X509_VERIFY_PARAM_set1_policies()' functions.", "severity": [ { @@ -29,10 +29,10 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "3.0.0" + "introduced": "300.0.0" }, { - "fixed": "3.0.8" + "fixed": "300.0.12" } ] } @@ -48,6 +48,10 @@ "type": "WEB", "url": "https://github.com/openssl/openssl/commit/7725e7bfe6f2ce8146b6552b44e0d226be7638e7" }, + { + "type": "PACKAGE", + "url": "https://github.com/alexcrichton/openssl-src-rs" + }, { "type": "WEB", "url": "https://www.openssl.org/news/secadv/20221213.txt"