Elastic Security Statement for OpenSSL CVE-2022-3786 and CVE-2022-3602, OpenSSL version 3.0.7

[Levine (Brian Levine)]

Elastic Products are not affected by this issue.

On Oct 25, 2022, Elastic became aware of the Forthcoming OpenSSL 3.0.7 Release announcement, which was made available on Nov 1, 2022. The security issues addressed in this release do not affect OpenSSL versions before 3.0.

Elastic has performed an investigation to identify any Elastic Products which may be impacted by this issue and we have concluded that no Elastic products use the versions of OpenSSL affected by these vulnerabilities. Therefore, Elastic Products are not affected by this issue.

Reference Links:

• CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buffer Overflows - OpenSSL Blog
• https://www.openssl.org/news/secadv/20221101.txt
• NVD - CVE-2022-3786
• NVD - CVE-2022-3602
• Forthcoming OpenSSL Releases