> Source: [sk180206](https://support.checkpoint.com/results/sk/sk180206)

# sk180206 - Check Point response to OpenSSL CVE-2022-3602 and CVE-2022-3786

| Property | Value |
|----------|-------|
| Solution ID | sk180206 |
| Date Created | 2022-10-31 |
| Last Modified | 2024-03-08 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |

## Symptoms

- On Tuesday, 1 November 2022, the OpenSSL project team released OpenSSL 3.0.7 update as a security-fix release ([OpenSSL Advisory](https://www.openssl.org/news/secadv/20221101.txt)).

This release includes 2 HIGH severity vulnerabilities and was assigned to **[CVE-2022-3602](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3602)** (Reduced from Critical)and**[CVE-2022-3786](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3786)**. These buffer overflow vulnerabilities in the Certificate could result in a denial of service or potentially remote code execution on affected versions.

The update affects only OpenSSL versions 3.0.0 through 3.0.6. (Version 3.0 was first released in September 2021). OpenSSL version 1.x is not affected by this vulnerability, therefore older operating systems and devices are safe.

## Solution

* **Check Point Products are not affected, except CloudGuard WAF.**
* **For CloudGuard WAF** , some agent deployments use a vulnerable OpenSSL library as SSL clients (whereas the vulnerability mainly impacts server side usage of SSL). Regardless, an updated version of those agents is published. Customers with agent upgrade mode set to "Automatic", receive the fixed version automatically. For additional information, refer to [this article](https://appsec-doc.inext.checkpoint.com/references/cve-2022-3786-and-cve-2022-3602-openssl-x.509-email-address-buffer-overflows-high).

<br />

**Check Point provides preventive behavioral protections for these vulnerabilities:**   

* **Quantum IPS protections** Check Point released this IPS protection to its Optimized and Strict profiles in PREVENT mode (by default) for both vulnerabilities: [OpenSSL Buffer Overflow (CVE-2022-3602)](http://www.checkpoint.com/defense/advisories/public/2022/CPAI-2022-0784.html).  
  NVD info: [CVE-2022-3602](https://nvd.nist.gov/vuln/detail/CVE-2022-3602), [CVE-2022-3786](https://nvd.nist.gov/vuln/detail/CVE-2022-3786)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content