Patches have been issued to fix a high-severity security flaw in the OpenSSL cryptographic library, which could be exploited by threat actors to facilitate remote code execution, reports The Hacker News.
The heap memory corruption vulnerability, tracked as CVE-2022-2274, was identified in OpenSSL version 3.0.4 and reported by Xidian University student Xi Ruoyao on June 22, a day after the vulnerable OpenSSL version was released.
"SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue," said OpenSSL in an advisory.
Malicious actors could leverage the "serious bug in the RSA implementation," which could trigger memory corruption, to remotely execute code on machines conducting computations, according to OpenSSL.
OpenSSL users have been urged to apply the OpenSSL version 3.0.5 upgrade to prevent threats related to the vulnerability.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.