CVE-2022-3602

CVE-2022-3602 is a buffer overrun vulnerability in OpenSSL versions 3.0.0 through 3.0.6, specifically affecting X.509 certificate verification during name constraint checking. This flaw impacts products like fedoraproject, netapp, and nodejs. With a CVSS score of 7.5 (HIGH), it allows an attacker to trigger a denial of service or potentially remote code execution by crafting a malicious email address in a certificate. While initially critical, mitigating factors like stack overflow protections led to a downgrade to high severity. There is no public exploit code available, nor is it actively exploited, but it has garnered significant community discussion and media coverage.