OpenSSL published a notification for a security-fix release. This update will include a Critical vulnerability for OpenSSL 3.0.x. No additional information or CVE number was published. The details will be made public on November 1st between 13 and 17 UTC. Let’s hope this is not another Heartbleed. The release came out on November 1st with CVE-2022-3602 and CVE-2022-3786, and the rating was downgraded to High the same day. A follow-up looks at why OpenSSL’s fuzzers missed the bug.
NCSC-NL collected information available so far. Prior to the publication potentially impacted components should identified to be able to act quickly.