CVE-2022-3996

A vulnerability was found in OpenSSL. This security flaw occurs if an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows), this issue results in a denial of service when the affected process hangs. Policy processing enabled on a publicly-facing server is not considered a standard setup. Policy processing is enabled by passing the -policy' argument to the command line utilities or by calling either the X509_VERIFY_PARAM_add0_policy()' or `X509_VERIFY_PARAM_set1_policies()' functions.

This CVE is marked as Not Affected for all Red Hat Products because the problem caused by this CVE (deadlock, potential DDoS) is platform-specific. Thread management implementation works well for Linux but causes deadlocks on Windows systems only.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.