CVE catalog
CVE-2022-2274
openssl: CVE-2022-2274
- Severity
- Critical · CVSS 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 48.23% · Oct 22, 2026
The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a consequence of the memory corruption an attacker may be able to trigger a remote code execution on the machine performing the computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | openssl | sid | 3.6.5-1 | fixed |
| Debian | openssl | forky | 3.6.5-1 | fixed |
| Debian | openssl | trixie | 3.5.7-1~deb13u2 | fixed |
| Debian | openssl | trixie-security | 3.5.7-1~deb13u3 | fixed |
| Debian | openssl | bookworm | 3.0.20-1~deb12u2 | fixed |
| Debian | openssl | bookworm-security | 3.0.22-1~deb12u1 | fixed |
| Cpe | openssl | Not reported | Not reported | unknown |
| Cpe | snapcenter | Not reported | Not reported | unknown |
| Cpe | h410c_firmware | Not reported | Not reported | unknown |
| Cpe | h300s_firmware | Not reported | Not reported | unknown |
| Cpe | h500s_firmware | Not reported | Not reported | unknown |
| Cpe | h700s_firmware | Not reported | Not reported | unknown |
| Cpe | h410s_firmware | Not reported | Not reported | unknown |
| Ubuntu | edk2 | pro | 0~20150106.5c2d456b-2 | vulnerable |
| Ubuntu | edk2 | pro | 0~20160104.c2a892d7-1 | vulnerable |
| Ubuntu | edk2 | pro | 0~20160408.ffea0a2c-2 | vulnerable |
| Ubuntu | edk2 | pro | 0~20160408.ffea0a2c-2ubuntu0.1 | vulnerable |
| Ubuntu | edk2 | pro | 0~20160408.ffea0a2c-2ubuntu0.2 | vulnerable |
| Ubuntu | edk2 | pro | 0~20160408.ffea0a2c-2ubuntu0.2+esm1 | vulnerable |
| Ubuntu | edk2 | pro | 0~20160408.ffea0a2c-2ubuntu0.2+esm3 | vulnerable |
| Ubuntu | edk2 | pro | 0~20160408.ffea0a2c-2ubuntu0.2+esm4 | vulnerable |
| Opensuse | openssh | tumbleweed | 9.3p1-1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | openssl | source | sid | 3.0.4-2 | not yet assigned | Not reported | [1013441] |
| Debian | openssl | source | forky | 3.0.4-2 | not yet assigned | Not reported | [1013441] |
| Debian | openssl | source | trixie | 3.0.4-2 | not yet assigned | Not reported | [1013441] |
| Debian | openssl | source | bookworm | 3.0.4-2 | not yet assigned | Not reported | [1013441] |
| Opensuse | openssh | rpm | tumbleweed | 9.3p1-1.1 | Not reported | OPENSUSE-SU-2024:12983-1 | Not reported |
OpenFactory catalog packages
[openSUSE Tumbleweed]
- [openssh-cavs]Unknown
Source package: [openssh]
Details (1)
10.5p1-1.1· x86_64 · tumbleweedUnknown · Fixed:
9.3p1-1.1Version impact unknown
dsa · openssh · opensuse · tumbleweed
- [openssh-clients]Unknown
Source package: [openssh]
Details (1)
10.5p1-1.1· x86_64 · tumbleweedUnknown · Fixed:
9.3p1-1.1Version impact unknown
dsa · openssh · opensuse · tumbleweed
- [openssh-common]Unknown
Source package: [openssh]
Details (1)
10.5p1-1.1· x86_64 · tumbleweedUnknown · Fixed:
9.3p1-1.1Version impact unknown
dsa · openssh · opensuse · tumbleweed
- [openssh-helpers]Unknown
Source package: [openssh]
Details (1)
10.5p1-1.1· x86_64 · tumbleweedUnknown · Fixed:
9.3p1-1.1Version impact unknown
dsa · openssh · opensuse · tumbleweed
- [openssh-server]Unknown
Source package: [openssh]
Details (1)
10.5p1-1.1· x86_64 · tumbleweedUnknown · Fixed:
9.3p1-1.1Version impact unknown
dsa · openssh · opensuse · tumbleweed
- [openssh-server-config-rootlogin]Unknown
Source package: [openssh]
Details (1)
10.5p1-1.1· x86_64 · tumbleweedUnknown · Fixed:
9.3p1-1.1Version impact unknown
dsa · openssh · opensuse · tumbleweed
- [openssh]Fixed
Source package: [openssh]
Details (1)
10.5p1-1.1· x86_64 · tumbleweedFixed · Fixed:
9.3p1-1.1dsa · openssh · opensuse · tumbleweed
[Debian 12 (Bookworm)]
- [libssl3]Fixed
Source package: [openssl]
Details (6)
3.0.20-1~deb12u2· amd64 · bookwormFixed · Fixed:
3.0.4-2dsa · openssl · debian · bookworm
3.0.20-1~deb12u2· arm64 · bookwormFixed · Fixed:
3.0.4-2dsa · openssl · debian · bookworm
3.0.20-1~deb12u2· amd64 · bookworm-securityFixed · Fixed:
3.0.4-2dsa · openssl · debian · bookworm
3.0.20-1~deb12u2· arm64 · bookworm-securityFixed · Fixed:
3.0.4-2dsa · openssl · debian · bookworm
3.0.17-1~deb12u2· amd64 · bookworm-updatesFixed · Fixed:
3.0.4-2dsa · openssl · debian · bookworm
3.0.17-1~deb12u2· arm64 · bookworm-updatesFixed · Fixed:
3.0.4-2dsa · openssl · debian · bookworm
- [libssl-dev]Fixed
Source package: [openssl]
Details (6)
3.0.20-1~deb12u2· amd64 · bookwormFixed · Fixed:
3.0.4-2dsa · openssl · debian · bookworm
3.0.20-1~deb12u2· arm64 · bookwormFixed · Fixed:
3.0.4-2dsa · openssl · debian · bookworm
3.0.20-1~deb12u2· amd64 · bookworm-securityFixed · Fixed:
3.0.4-2dsa · openssl · debian · bookworm
3.0.20-1~deb12u2· arm64 · bookworm-securityFixed · Fixed:
3.0.4-2dsa · openssl · debian · bookworm
3.0.17-1~deb12u2· amd64 · bookworm-updatesFixed · Fixed:
3.0.4-2dsa · openssl · debian · bookworm
3.0.17-1~deb12u2· arm64 · bookworm-updatesFixed · Fixed:
3.0.4-2dsa · openssl · debian · bookworm
- [libssl-doc]Fixed
Source package: [openssl]
Details (6)
3.0.20-1~deb12u2· all · bookwormFixed · Fixed:
3.0.4-2dsa · openssl · debian · bookworm
3.0.20-1~deb12u2· all · bookwormFixed · Fixed:
3.0.4-2dsa · openssl · debian · bookworm
3.0.20-1~deb12u2· all · bookworm-securityFixed · Fixed:
3.0.4-2dsa · openssl · debian · bookworm
3.0.20-1~deb12u2· all · bookworm-securityFixed · Fixed:
3.0.4-2dsa · openssl · debian · bookworm
3.0.17-1~deb12u2· all · bookworm-updatesFixed · Fixed:
3.0.4-2dsa · openssl · debian · bookworm
3.0.17-1~deb12u2· all · bookworm-updatesFixed · Fixed:
3.0.4-2dsa · openssl · debian · bookworm
- [openssl]Fixed
Details (6)
3.0.20-1~deb12u2· amd64 · bookwormFixed · Fixed:
3.0.4-2dsa · openssl · debian · bookworm
3.0.20-1~deb12u2· arm64 · bookwormFixed · Fixed:
3.0.4-2dsa · openssl · debian · bookworm
3.0.20-1~deb12u2· amd64 · bookworm-securityFixed · Fixed:
3.0.4-2dsa · openssl · debian · bookworm
3.0.20-1~deb12u2· arm64 · bookworm-securityFixed · Fixed:
3.0.4-2dsa · openssl · debian · bookworm
3.0.17-1~deb12u2· amd64 · bookworm-updatesFixed · Fixed:
3.0.4-2dsa · openssl · debian · bookworm
3.0.17-1~deb12u2· arm64 · bookworm-updatesFixed · Fixed:
3.0.4-2dsa · openssl · debian · bookworm
Observed:
References
- [https://cert-portal.siemens.com/productcert/csaf/ssa-332410.json]
- [https://ftp.suse.com/pub/projects/security/]
- [https://nvd.nist.gov/vuln/detail/CVE-2022-2274]
- [https://osv.dev/vulnerability/ALPINE-CVE-2022-2274]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2022-2274]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:12983-1]
- [https://security-tracker.debian.org/tracker/CVE-2022-2274]
- [https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0123.json]
[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]