OpenSSL CVE-2022-3602 & CVE-2022-3786: The Vulnerability That Wasn't Heartbleed 2.0

1. The Week the Web Prepared for Heartbleed 2.0

On October 25, 2022, the OpenSSL Project issued a pre-announcement that version 3.0.7 would patch a CRITICAL security vulnerability — the first critical rating since Heartbleed (2014). When the patch was published on November 1, the flaw was downgraded to HIGH: CVE-2022-3602 and CVE-2022-3786, a 4-byte buffer overrun in X.509 email address punycode decoding.

2. OpenSSL Vulnerability Comparison Matrix

3. Technical Root Cause: The Punycode Buffer Overrun

Punycode converts non-ASCII Unicode strings into ASCII (prefixed with xn--). In crypto/punycode.c, when decoding malformed email addresses in X.509 certificates, OpenSSL undercounted the buffer index:

// In OpenSSL 3.0.x crypto/punycode.c
if (out_len < max_out) {
    output[out_len++] = digit; // 4-byte stack overwrite past buffer boundary
}

Modern compiler protections (Stack Canaries / SSP, ASLR, NX) reliably caused __stack_chk_fail() to terminate the process instantly rather than allowing code execution.

4. Detection and Remediation

# Audit installed OpenSSL version on Linux
openssl version -a
# Upgrade OpenSSL package to 3.0.7+ or 1.1.1s+
sudo apt update && sudo apt --only-upgrade install openssl libssl-dev