Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-1473

The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).

Published

2022-05-03T16:15:18.957

Last Modified

2025-05-05T17:17:34.867

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-459
  • Type: Secondary
    CWE-459
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application openssl openssl < 3.0.3 Yes
Application netapp active_iq_unified_manager - Yes
Application netapp clustered_data_ontap - Yes
Application netapp clustered_data_ontap_antivirus_connector - Yes
Application netapp santricity_smi-s_provider - Yes
Application netapp smi-s_provider - Yes
Application netapp snapmanager - Yes
Application netapp solidfire\,_enterprise_sds_\&_hci_storage_node - Yes
Application netapp solidfire_\&_hci_management_node - Yes
Operating System netapp a700s_firmware - Yes
Hardware netapp a700s - No
Operating System netapp h300s_firmware - Yes
Hardware netapp h300s - No
Operating System netapp h500s_firmware - Yes
Hardware netapp h500s - No
Operating System netapp h700s_firmware - Yes
Hardware netapp h700s - No
Operating System netapp h300e_firmware - Yes
Hardware netapp h300e - No
Operating System netapp h500e_firmware - Yes
Hardware netapp h500e - No
Operating System netapp h700e_firmware - Yes
Hardware netapp h700e - No
Operating System netapp h410s_firmware - Yes
Hardware netapp h410s - No
Operating System netapp aff_8300_firmware - Yes
Hardware netapp aff_8300 - No
Operating System netapp fas_8300_firmware - Yes
Hardware netapp fas_8300 - No
Operating System netapp aff_8700_firmware - Yes
Hardware netapp aff_8700 - No
Operating System netapp fas_8700_firmware - Yes
Hardware netapp fas_8700 - No
Operating System netapp aff_a400_firmware - Yes
Hardware netapp aff_a400 - No
Operating System netapp fabric-attached_storage_a400_firmware - Yes
Hardware netapp fabric-attached_storage_a400 - No
Operating System netapp a250_firmware - Yes
Hardware netapp a250 - No
Operating System netapp aff_500f_firmware - Yes
Hardware netapp aff_500f - No
Operating System netapp fas_500f_firmware - Yes
Hardware netapp fas_500f - No
References