Background
Recently, two security vulnerabilities were discovered inside OpenSSL version 3.x
CVE-2022-3786: https://nvd.nist.gov/vuln/detail/CVE-2022-3786
CVE-2022-3602: https://nvd.nist.gov/vuln/detail/CVE-2022-3602
The vulnerability *3602 was initially believed to be “Critical” because it allows either DoS of the receiving server, or possible Remote Code Execution. The vulnerability *3786 was initially believed to be “Critical” because it allows DoS of the remote server. Both vulnerabilities have since been downgraded to “High” due to the complexity of implementation and that it was unlikely to permit RCE.
Many organizations, including Pharos customers, are urgently investigating where this tool is used and how to update/repair those instances.
Pharos Software and OpenSSL
Pharos has reviewed all our software, 3rd party tools/libraries, internal infrastructure and cloud infrastructure and can confirm that we are not susceptible to OpenSSL 3.x vulnerability.
Two internal administration systems (not accessible externally) do use OpenSSL 3.x and will be upgraded shortly.