CVE-2022-4450 @ Janus

"CVE-2022-4450"
"openssl-1.1.1n-0+deb10u6"
"Am I vulnerable?"

Status

new

Priority

0.62

Match score

4.0

Risk

DoS Remote

CVSS

7.5 HIGH

Reason

cpe: openssl; pkgs: openssl; version: in-range: openssl-1.1.1n-0+deb10u6; risk:dos

Created

2026-10-15T10:20:32Z

Updated

2026-10-20T10:18:41Z

Package interrogation (copy)

Run on the host — click to copy a command. Debian/apt

Package	Commands
openssl-1.1.1n-0+deb10u6

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Suggestions: openssl

Same product CVEs in your queue

Other open tickets that look like the same product. Closed tickets are omitted unless they are already pegged to this CVE.

CVE	CVSS	Systems	Status	Matched	Already related
CVE-2021-20232	9.8	Saiph	new	openssl	—
CVE-2021-20231	9.8	Saiph	new	openssl	—
CVE-2023-4807	7.8	Archive, Janus, Saiph	new	openssl	—
CVE-2022-0778	7.5	Library, morris, mufasa	new	openssl	—
CVE-2023-0215	7.5	Archive, Janus, Saiph, morris, mufasa	new	openssl	—
CVE-2023-0464	7.5	Archive, Janus, Saiph, morris, mufasa	new	openssl	—
CVE-2024-0553	7.5	Library, Saiph	new	openssl	—
CVE-2020-24659	7.5	Library, Saiph	new	openssl	—
CVE-2022-2509	7.5	Library, Saiph	new	openssl	—
CVE-2023-0286	7.4	Archive, Janus, Saiph, morris, mufasa	new	openssl	—
CVE-2020-13777	7.4	Saiph	new	openssl	—
CVE-2022-2068	7.3	Archive, Janus, Saiph, morris, mufasa	new	openssl	—
CVE-2022-1292	7.3	Archive, Janus, Saiph, morris, mufasa	new	openssl	—

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Host OS / kernel

Debian GNU/Linux 10 (buster) (10) · debian

Arch

x86_64

kernel_release

uname -r → 4.19.0-27-amd64

kernel_version

uname -v → #1 SMP Debian 4.19.316-1 (2024-06-25)

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Same CVE on other hosts

Open the ticket for this CVE on another system.

System	Status	Priority	Updated
Archive	new	0.62	2026-10-20T10:18:41Z	Open
Saiph	new	0.62	2026-10-20T10:18:41Z	Open

Description

The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and
decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data.
If the function succeeds then the "name_out", "header" and "data" arguments are
populated with pointers to buffers containing the relevant decoded data. The
caller is responsible for freeing those buffers. It is possible to construct a
PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex()
will return a failure code but will populate the header argument with a pointer
to a buffer that has already been freed. If the caller also frees this buffer
then a double free will occur. This will most likely lead to a crash. This
could be exploited by an attacker who has the ability to supply malicious PEM
files for parsing to achieve a denial of service attack.

The functions PEM_read_bio() and PEM_read() are simple wrappers around
PEM_read_bio_ex() and therefore these functions are also directly affected.

These functions are also called indirectly by a number of other OpenSSL
functions including PEM_X509_INFO_read_bio_ex() and
SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal
uses of these functions are not vulnerable because the caller does not free the
header argument if PEM_read_bio_ex() returns a failure code. These locations
include the PEM_read_bio_TYPE() functions as well as the decoders introduced in
OpenSSL 3.0.

The OpenSSL asn1parse command line application is also impacted by this issue.

Update status

Add note only

References

NVD: CVE-2022-4450