{"id":80591,"date":"2022-12-08T09:12:00","date_gmt":"2022-12-08T14:12:00","guid":{"rendered":"https:\/\/staging.checkmarx.com\/?p=80591"},"modified":"2024-08-15T13:58:07","modified_gmt":"2024-08-15T13:58:07","slug":"openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning","status":"publish","type":"post","link":"https:\/\/checkmarx.com\/blog\/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning\/","title":{"rendered":"OpenSSL CVE-2022-3786: Food for Thought on the Importance of Security Scanning\u00a0"},"content":{"rendered":"<p>\n\n\n<\/p>\n<p>After a CVE on open-source software has been discovered and a fix has been released, a fruitful practice for security researchers is to go deep into the nature of the CVE and the fix.&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>In addition to curiosity, this good practice helps professionals and researchers extend their knowledge and improve their understanding of security vulnerabilities.&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>Being an engineer at Checkmarx, the main tool that comes to mind to deep dive into the nature of vulnerabilities is the Checkmarx Static Application Security Testing (SAST) engine.&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>This blog post will go into details about the nature of two separate vulnerabilities, CVE-2022-3602 and CVE-2022-3786, which hit the news at the beginning of November impacting a very well-known and largely adopted open-source software package, OpenSSL. We will explore their fix and how Checkmarx solutions can detect such vulnerable code and support developers with remediation.&nbsp;&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<h2 class=\"wp-block-heading article-anchor\" id=\"article-anchor-1\">CVE-2022-3602 and CVE-2022-3786&nbsp;<\/h2>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>The official page from OpenSSL, dealing with November\u2019s CVEs (CVE-2022-3786 and CVE-2022-3602) can be found <a href=\"https:\/\/www.openssl.org\/news\/vulnerabilities.html\" target=\"_blank\" rel=\"noreferrer noopener\">here<\/a>.&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>The two vulnerabilities affect OpenSSL up to version 3.0.6, and they involve a file named punycode.c, which is one of the files that manage the parsing of specific encoding of domain names (known as punycode).&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>With both vulnerabilities, \u201cA buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking\u201d, and they have been classified as CWE-120 by NIST, as a \u201cClassical Buffer Overflow.\u201d&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<h2 class=\"wp-block-heading article-anchor\" style=\"text-transform:capitalize\" id=\"article-anchor-2\">Buffer overflows<\/h2>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>Generally, in C language, it is important to securely manage memory buffers to avoid any value written in a buffer from being reused elsewhere in the code and being interpreted with unexpected semantics. It\u2019s worth noting that in C, buffers include strings too!&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>Traditionally, strings are represented as a region of memory containing data terminated with a NULL character. Different string handling methods may rely on this NULL character to determine the length of the string. If a buffer that does not contain a NULL terminator is passed to one of these functions, the function will read past the end of the buffer or will lead to unexpected behaviors, such as buffer overflows.&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>Let\u2019s go through some technical details on the nature of the two OpenSSL vulnerabilities.&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<h2 class=\"wp-block-heading article-anchor\" style=\"text-transform:capitalize\" id=\"article-anchor-3\">CVE-2022-3602&nbsp;<\/h2>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>It is a buffer overflow related to the function ossl_punycode_decode, where there is a check on the size of a buffer for larger-than (&gt;) values but omits the equals-to (=) values out of any check, as seen below.&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>The red highlight is the old version of the ossl_punycode_decode source code (OpenSSL 3.0.6), while the green one is the fixed version (OpenSSL 3.0.7).&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>The check at line 184 was leaving the case \u201c=\u201d unchecked, letting data with the same size of max_out variable to reach the next lines in the program and enter the further part of the function.&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>The fix addresses such a case, by adding the \u201c=\u201d case to the ones that must be excluded with return 0.&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/checkmarx.com\/wp-content\/uploads\/2022\/12\/image-7.png\" alt=\"\"><\/figure>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>According to this evidence, the buffer overflow is due to the absence of a proper check against the size of a buffer which EQUALS the maximum, while there are cases defined to address sizes that are larger (return 0) and smaller (just continue).&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>Technically, this case is similar to off-by-one vulnerabilities, where an application does not properly manage buffers which are exactly the size of the maximum expected, due to several assumptions on the data structures received in input.&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>Various assumptions can be done on data structures received in input, and they all deal about trusting the source of such input, in term of its content, its format, and its size; to build secure code, assumptions should be avoided.&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>Instead, sanitization and validation techniques should be implemented in the code: sanitization is the activity of removing extraneous data from a given input, transforming it into harmless data, compatible with business rules and security policies (e.g. removing special characters from a string before using it as a parameter in SQL); validation, on the other hand, is the activity of checking the content of a given input and rejecting any input that does not comply with application\u2019s constraints (e.g. rejecting any string that is greater or equals to the size of a memory buffer).&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>Checkmarx\u2019s Codebashing training platform offers several lessons to teach developers how to write secure code in C, addressing proper methods to manage structures such as buffers, stacks, and heaps, which can help developers avoid introducing vulnerabilities in their code, such as CVE-2022-3602.&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>For example, regarding off-by-one, Checkmarx\u2019s gamified platform shows the student a part of vulnerable code and its side effects at runtime, both in memory and interactively:&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/checkmarx.com\/wp-content\/uploads\/2022\/12\/image-1-1024x566-1.png\" alt=\"\"><\/figure>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>In this scenario, the vulnerable code is robust when the buffer is larger or smaller than the expected size; however, it is not safe when exactly 8 characters are entered.&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<h2 class=\"wp-block-heading article-anchor\" style=\"text-transform:capitalize\" id=\"article-anchor-4\">CVE-2022-3786&nbsp;<\/h2>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>t is a buffer overflow related to the function ossl_punycode_decode, which manages several cases of writing characters (chars) to a buffer, before using that buffer in further contexts, such as reading it as a string.&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>OpenSSL 3.0.7 introduced the use of this PUSHC macro, to manage operations in buffers properly, as stacks:&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/checkmarx.com\/wp-content\/uploads\/2022\/12\/image-2-1.png\" alt=\"\"><\/figure>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>The macro is then used in place of old 3.0.6 \u201cmemcpy\u201d functions, everywhere it is needed.&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>Similar to the previous example above, the red highlight is the old version of the ossl_punycode_decode source code (OpenSSL 3.0.6), while the green one is the fixed version (OpenSSL 3.0.7).&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/checkmarx.com\/wp-content\/uploads\/2022\/12\/image-5-652x1024-1.png\" alt=\"\"><\/figure>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>The change on line 301 manages the absence of the NULL character, which may lead to unexpected behaviors if the just populated stack is used in other contexts (e.g., as a string!).&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>Checkmarx SAST has a specific query for C\/C++ Language which is called \u201cImproper_Null_Termination.\u201d It is in the category of Buffer Overflows, and it has High severity.&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>Its goal is to identify buffers that have not been properly terminated by NULL characters.&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/checkmarx.com\/wp-content\/uploads\/2022\/12\/image-3-1.png\" alt=\"\"><\/figure>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>By scanning OpenSSL 3.0.6 with Checkmarx SAST, the punycode file appears in two results related to line 276 and 297 for Improper Null Termination query:&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/checkmarx.com\/wp-content\/uploads\/2022\/12\/image-6-1.png\" alt=\"\"><\/figure>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>The description of the finding at line 276 states:&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p><em>\u201cThe buffer <\/em><strong><em>outptr<\/em><\/strong><em> in <\/em><strong><em>openssl-openssl-3.0.6cryptopunycode.c<\/em><\/strong><em> at <\/em><strong><em>line 276<\/em><\/strong><em> does not have a <\/em><strong><em>null<\/em><\/strong><em> terminator. Any subsequent operations on this buffer that treat it as a null-terminated string will result in unexpected or dangerous behavior.\u201d<\/em>&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>By scanning OpenSSL 3.0.7 with the same preset, the two vulnerabilities appear as fixed:&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/checkmarx.com\/wp-content\/uploads\/2022\/12\/image-4-2.png\" alt=\"\"><\/figure>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<h2 class=\"wp-block-heading article-anchor\" id=\"article-anchor-5\">Conclusion<\/h2>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>Any application may present vulnerabilities due to the large size of applications, inheritances from older versions, mistakes, or errors. As evident with the recently identified OpenSSL vulnerabilities, even well-maintained and mature applications may present vulnerabilities that could be all but impossible to be identified by a manual review of the code.&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p>At the same time, the security awareness of developers is a key factor to produce and maintain secure code.&nbsp;<\/p>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p><a href=\"https:\/\/checkmarx.com\/cxsast-source-code-scanning\/\" target=\"_blank\" rel=\"noreferrer noopener\">Checkmarx SAST<\/a> and <a href=\"https:\/\/checkmarx.com\/product\/codebashing-secure-code-training\/\" target=\"_blank\" rel=\"noreferrer noopener\">Checkmarx Codebashing<\/a> can help in raising the bar of security in your company and in your developers and security champions. Both solutions are fully integrated into our Checkmarx One\u2122 Application Security Platform.&nbsp; <\/p>\n\n\n\n<p>\n\n\n<\/p>\n<hr>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<h2 class=\"wp-block-heading article-anchor\" id=\"article-anchor-6\">Learn More <\/h2>\n<p>\n\n\n<\/p>\n<p>\n\n\n<\/p>\n<p><strong>To learn more or see for yourself, <a href=\"https:\/\/checkmarx.com\/request-a-demo\/\" target=\"_blank\" rel=\"noreferrer noopener\">request a demo today<\/a>!&nbsp;<\/strong><\/p>\n<p>\n\n\n<\/p>","protected":false},"excerpt":{"rendered":"<p>After a CVE on open-source software has been discovered and a fix has been released, a fruitful practice for security researchers is to go deep into the nature of the CVE and the fix.&nbsp; In addition to curiosity, this good practice helps professionals and researchers extend their knowledge and improve their understanding of security vulnerabilities.&nbsp; [&hellip;]<\/p>\n","protected":false},"author":71,"featured_media":80599,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[84],"tags":[142,87,189,412,215,190,16,236],"class_list":["post-80591","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-application-security-testing","tag-appsec","tag-article","tag-checkmarx-one","tag-codebashing","tag-english","tag-sast","tag-static-application-security-testing"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.1.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>OpenSSL CVE-2022-3786: Food for Thought on the Importance of Security Scanning\u00a0<\/title>\n<meta name=\"description\" content=\"Learn best practices after a CVE is discovered in open-source software\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/checkmarx.com\/blog\/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"OpenSSL CVE-2022-3786\" \/>\n<meta property=\"og:description\" content=\"Food for thought on the importance of security scanning\" \/>\n<meta property=\"og:url\" content=\"https:\/\/checkmarx.com\/blog\/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning\/\" \/>\n<meta property=\"og:site_name\" content=\"Checkmarx\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Checkmarx.Source.Code.Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2022-12-08T14:12:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-08-15T13:58:07+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/checkmarx.com\/wp-content\/uploads\/2022\/12\/computer.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1600\" \/>\n\t<meta property=\"og:image:height\" content=\"800\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Fabrizio Bugli\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"OpenSSL CVE-2022-3786\" \/>\n<meta name=\"twitter:description\" content=\"Food for thought on the importance of security scanning\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/checkmarx.com\/wp-content\/uploads\/2022\/12\/computer.jpg\" \/>\n<meta name=\"twitter:creator\" content=\"@checkmarx\" \/>\n<meta name=\"twitter:site\" content=\"@checkmarx\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fabrizio Bugli\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/checkmarx.com\/blog\/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/checkmarx.com\/blog\/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning\/\"},\"author\":{\"name\":\"Fabrizio Bugli\",\"@id\":\"https:\/\/checkmarx.com\/#\/schema\/person\/d4e990f0472b26aceb28e3901128021c\"},\"headline\":\"OpenSSL CVE-2022-3786: Food for Thought on the Importance of Security Scanning\u00a0\",\"datePublished\":\"2022-12-08T14:12:00+00:00\",\"dateModified\":\"2024-08-15T13:58:07+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/checkmarx.com\/blog\/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning\/\"},\"wordCount\":1222,\"publisher\":{\"@id\":\"https:\/\/checkmarx.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/checkmarx.com\/blog\/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/checkmarx.com\/wp-content\/uploads\/2022\/12\/computer.jpg\",\"keywords\":[\"Application Security Testing\",\"AppSec\",\"Article\",\"checkmarx one\",\"Codebashing\",\"English\",\"SAST\",\"Static Application Security Testing\"],\"articleSection\":[\"Blog\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/checkmarx.com\/blog\/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning\/\",\"url\":\"https:\/\/checkmarx.com\/blog\/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning\/\",\"name\":\"OpenSSL CVE-2022-3786: Food for Thought on the Importance of Security Scanning\u00a0\",\"isPartOf\":{\"@id\":\"https:\/\/checkmarx.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/checkmarx.com\/blog\/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/checkmarx.com\/blog\/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/checkmarx.com\/wp-content\/uploads\/2022\/12\/computer.jpg\",\"datePublished\":\"2022-12-08T14:12:00+00:00\",\"dateModified\":\"2024-08-15T13:58:07+00:00\",\"description\":\"Learn best practices after a CVE is discovered in open-source software\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/checkmarx.com\/blog\/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/checkmarx.com\/blog\/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning\/#primaryimage\",\"url\":\"https:\/\/checkmarx.com\/wp-content\/uploads\/2022\/12\/computer.jpg\",\"contentUrl\":\"https:\/\/checkmarx.com\/wp-content\/uploads\/2022\/12\/computer.jpg\",\"width\":1600,\"height\":800},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/checkmarx.com\/#website\",\"url\":\"https:\/\/checkmarx.com\/\",\"name\":\"Checkmarx\",\"description\":\"The world runs on code. We secure it.\",\"publisher\":{\"@id\":\"https:\/\/checkmarx.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/checkmarx.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/checkmarx.com\/#organization\",\"name\":\"Checkmarx\",\"url\":\"https:\/\/checkmarx.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/checkmarx.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/02\/logo-dark.svg\",\"contentUrl\":\"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/02\/logo-dark.svg\",\"width\":1,\"height\":1,\"caption\":\"Checkmarx\"},\"image\":{\"@id\":\"https:\/\/checkmarx.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/Checkmarx.Source.Code.Analysis\",\"https:\/\/x.com\/checkmarx\",\"https:\/\/www.youtube.com\/user\/CheckmarxResearchLab\",\"https:\/\/www.linkedin.com\/company\/checkmarx\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/checkmarx.com\/#\/schema\/person\/d4e990f0472b26aceb28e3901128021c\",\"name\":\"Fabrizio Bugli\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/checkmarx.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/06\/avatar_71.jpg\",\"contentUrl\":\"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/06\/avatar_71.jpg\",\"caption\":\"Fabrizio Bugli\"},\"url\":\"https:\/\/checkmarx.com\/author\/fabriziobugli\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"OpenSSL CVE-2022-3786: Food for Thought on the Importance of Security Scanning\u00a0","description":"Learn best practices after a CVE is discovered in open-source software","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/checkmarx.com\/blog\/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning\/","og_locale":"en_US","og_type":"article","og_title":"OpenSSL CVE-2022-3786","og_description":"Food for thought on the importance of security scanning","og_url":"https:\/\/checkmarx.com\/blog\/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning\/","og_site_name":"Checkmarx","article_publisher":"https:\/\/www.facebook.com\/Checkmarx.Source.Code.Analysis","article_published_time":"2022-12-08T14:12:00+00:00","article_modified_time":"2024-08-15T13:58:07+00:00","og_image":[{"width":1600,"height":800,"url":"https:\/\/checkmarx.com\/wp-content\/uploads\/2022\/12\/computer.jpg","type":"image\/jpeg"}],"author":"Fabrizio Bugli","twitter_card":"summary_large_image","twitter_title":"OpenSSL CVE-2022-3786","twitter_description":"Food for thought on the importance of security scanning","twitter_image":"https:\/\/checkmarx.com\/wp-content\/uploads\/2022\/12\/computer.jpg","twitter_creator":"@checkmarx","twitter_site":"@checkmarx","twitter_misc":{"Written by":"Fabrizio Bugli","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/checkmarx.com\/blog\/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning\/#article","isPartOf":{"@id":"https:\/\/checkmarx.com\/blog\/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning\/"},"author":{"name":"Fabrizio Bugli","@id":"https:\/\/checkmarx.com\/#\/schema\/person\/d4e990f0472b26aceb28e3901128021c"},"headline":"OpenSSL CVE-2022-3786: Food for Thought on the Importance of Security Scanning\u00a0","datePublished":"2022-12-08T14:12:00+00:00","dateModified":"2024-08-15T13:58:07+00:00","mainEntityOfPage":{"@id":"https:\/\/checkmarx.com\/blog\/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning\/"},"wordCount":1222,"publisher":{"@id":"https:\/\/checkmarx.com\/#organization"},"image":{"@id":"https:\/\/checkmarx.com\/blog\/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning\/#primaryimage"},"thumbnailUrl":"https:\/\/checkmarx.com\/wp-content\/uploads\/2022\/12\/computer.jpg","keywords":["Application Security Testing","AppSec","Article","checkmarx one","Codebashing","English","SAST","Static Application Security Testing"],"articleSection":["Blog"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/checkmarx.com\/blog\/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning\/","url":"https:\/\/checkmarx.com\/blog\/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning\/","name":"OpenSSL CVE-2022-3786: Food for Thought on the Importance of Security Scanning\u00a0","isPartOf":{"@id":"https:\/\/checkmarx.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/checkmarx.com\/blog\/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning\/#primaryimage"},"image":{"@id":"https:\/\/checkmarx.com\/blog\/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning\/#primaryimage"},"thumbnailUrl":"https:\/\/checkmarx.com\/wp-content\/uploads\/2022\/12\/computer.jpg","datePublished":"2022-12-08T14:12:00+00:00","dateModified":"2024-08-15T13:58:07+00:00","description":"Learn best practices after a CVE is discovered in open-source software","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/checkmarx.com\/blog\/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/checkmarx.com\/blog\/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning\/#primaryimage","url":"https:\/\/checkmarx.com\/wp-content\/uploads\/2022\/12\/computer.jpg","contentUrl":"https:\/\/checkmarx.com\/wp-content\/uploads\/2022\/12\/computer.jpg","width":1600,"height":800},{"@type":"WebSite","@id":"https:\/\/checkmarx.com\/#website","url":"https:\/\/checkmarx.com\/","name":"Checkmarx","description":"The world runs on code. We secure it.","publisher":{"@id":"https:\/\/checkmarx.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/checkmarx.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/checkmarx.com\/#organization","name":"Checkmarx","url":"https:\/\/checkmarx.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/checkmarx.com\/#\/schema\/logo\/image\/","url":"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/02\/logo-dark.svg","contentUrl":"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/02\/logo-dark.svg","width":1,"height":1,"caption":"Checkmarx"},"image":{"@id":"https:\/\/checkmarx.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/Checkmarx.Source.Code.Analysis","https:\/\/x.com\/checkmarx","https:\/\/www.youtube.com\/user\/CheckmarxResearchLab","https:\/\/www.linkedin.com\/company\/checkmarx"]},{"@type":"Person","@id":"https:\/\/checkmarx.com\/#\/schema\/person\/d4e990f0472b26aceb28e3901128021c","name":"Fabrizio Bugli","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/checkmarx.com\/#\/schema\/person\/image\/","url":"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/06\/avatar_71.jpg","contentUrl":"https:\/\/checkmarx.com\/wp-content\/uploads\/2024\/06\/avatar_71.jpg","caption":"Fabrizio Bugli"},"url":"https:\/\/checkmarx.com\/author\/fabriziobugli\/"}]}},"_links":{"self":[{"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/posts\/80591","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/users\/71"}],"replies":[{"embeddable":true,"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/comments?post=80591"}],"version-history":[{"count":0,"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/posts\/80591\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/media\/80599"}],"wp:attachment":[{"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/media?parent=80591"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/categories?post=80591"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/checkmarx.com\/wp-json\/wp\/v2\/tags?post=80591"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}