Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2022-1434: The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key

48
This month
MEDIUM 5.9REMOTEWATCHLISTUPGRADEMITIGATEMITIGATE

CVE-2022-1434 is a medium-severity flaw (CVSS 5.9) affecting openssl, active iq unified manager, clustered data ontap. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker could exploit this issue by performing a man-in-the-middle attack to modify data being sent from one endpoint to an OpenSSL 3.0 recipient such that the modified data would still pass the MAC integrity check. Note that data sent from an OpenSSL 3.0 endpoint to a non-OpenSSL 3.0 endpoint w

Why this priority

  • Remotely exploitable, no login, no user action
  • On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score5.9 (Medium)
Attack vectorNetwork (remote)
Attack complexityHigh
Privileges neededNone
User interactionNone
EPSS exploit chance1.2% (top 31%)
CISA exploited listNo
WeaknessCWE-327
Published2022-05-03
Last modified2026-10-14
Publisher (CNA): OpenSSL Software Foundation · Vendor: netapp · openssl

Share: LinkedIn · X · Reddit

Last updated 2026-10-14 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

openssl openssl UPGRADE
Affected: >= 3.0.0 and < 3.0.3
Fixed in: 3.0.3
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy openssl || rpm -q openssl || openssl --version
2. UPGRADE to 3.0.3 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade openssl
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade openssl
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
netapp active iq unified manager MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy active-iq-unified-manager || rpm -q active-iq-unified-manager || active-iq-unified-manager --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
netapp clustered data ontap MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy clustered-data-ontap || rpm -q clustered-data-ontap || clustered-data-ontap --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
netapp clustered data ontap antivirus connector MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy clustered-data-ontap-antivirus-connector || rpm -q clustered-data-ontap-antivirus-connector || clustered-data-ontap-antivirus-connector --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
netapp santricity smi-s provider MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy santricity-smi-s-provider || rpm -q santricity-smi-s-provider || santricity-smi-s-provider --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
netapp smi-s provider MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy smi-s-provider || rpm -q smi-s-provider || smi-s-provider --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2022-1434?

openssl: upgrade to 3.0.3; active iq unified manager: mitigate or apply the listed mitigation; clustered data ontap: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2022-1434 being exploited?

CVE-2022-1434 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2022-1434 affect?

CVE-2022-1434 affects openssl, active iq unified manager, clustered data ontap. Severity is medium (CVSS 5.9). The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker could exploit this issue by performing a man-in-the-middle attack to modify da

How urgent is CVE-2022-1434?

Priority 48/100. Remotely exploitable, no login, no user action; On your watchlist

Software pages

OpenSSL vulnerabilities

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.