Pharos response to OpenSSL 3.x vulnerability - November 2022

Background 

Recently, two security vulnerabilities were discovered inside OpenSSL version 3.x 

• CVE-2022-3786:  https://nvd.nist.gov/vuln/detail/CVE-2022-3786  

• CVE-2022-3602:  https://nvd.nist.gov/vuln/detail/CVE-2022-3602   

The vulnerability *3602 was initially believed to be “Critical” because it allows either DoS of the receiving server, or possible Remote Code Execution. The vulnerability *3786 was initially believed to be “Critical” because it allows DoS of the remote server. Both vulnerabilities have since been downgraded to “High” due to the complexity of implementation and that it was unlikely to permit RCE. 

Many organizations, including Pharos customers, are urgently investigating where this tool is used and how to update/repair those instances.   

Pharos Software and OpenSSL 

Pharos has reviewed all our software, 3rd party tools/libraries, internal infrastructure and cloud infrastructure and can confirm that we are not susceptible to OpenSSL 3.x vulnerability. 

Two internal administration systems (not accessible externally) do use OpenSSL 3.x and will be upgraded shortly.