CVE-2022-3602 and CVE-2022-3786

OpenSSL disclosed critical-sounding vulnerabilities (CVE-2022-3602 and CVE-2022-3786) affecting OpenSSL 3.0.0+; after further analysis the severity was downgraded to high. Arctic Wolf Labs reports that remote code execution is theoretically possible only in constrained scenarios requiring a certificate authority to sign a malicious certificate, and no active exploitation has been observed; organizations are advised to patch affected applications as part of normal patch cycles rather than out-of-band.