Symptom
Openssl has announced a vulnerability CVE-2022-3996 and it's unclear that if Netweaver ABAP environment will be impacted.
Detailed Description for CVE-2022-3996:
If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy processing being enabled on a publicly facing server is not considered to be a common setup. Policy processing is enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. Update (31 March 2023): The description of the policy processing enablement was corrected based on CVE-2023-0466.
Read more...
Environment
Netweaver AS ABAP
Product
Keywords
TLS, CVE-2022-3996, Netweaver, AS ABAP, Openssl , KBA , BC-SEC-SSL , Secure Sockets Layer Protocol , Problem
About this page
This is a preview of a SAP Knowledge Base Article. Click more to access the full version on SAP for Me (Login required).Search for additional results
Visit SAP Support Portal's SAP Notes and KBA Search.
SAP Knowledge Base Article - Preview