New OpenSSL 3.0 vulnerabilities: What you need to know to find and fix them

This post details the discovery and mitigation of two OpenSSL 3.0 vulnerabilities (CVE-2022-3786 and CVE-2022-3602) affecting X.509 email address buffer overflows. It explains how the vulnerabilities work, the risk to organizations using OpenSSL 3.0, and confirms that GitLab's production systems were not impacted. It also notes that GitLab's DAST analyzer was updated to patch the vulnerable library.