# Statement Regarding OpenSSL Vulnerabilities 2022-11-01

**URL:** https://meta.discourse.org/t/statement-regarding-openssl-vulnerabilities-2022-11-01/244230
**Category:** Announcements
**Tags:** security
**Created:** [November 3, 2022, 7:38pm UTC](https://meta.discourse.org/t/statement-regarding-openssl-vulnerabilities-2022-11-01/244230 "2022-11-03T19:38:57Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![jomaxro](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jomaxro/32/126216_2.png) [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [November 3, 2022, 7:38pm UTC](https://meta.discourse.org/t/statement-regarding-openssl-vulnerabilities-2022-11-01/244230/1 "2022-11-03T19:38:57Z")

</div>

The distributed Discourse image (used by both self-hosters and on our SaaS platform) uses Debian OpenSSL 1.1.1n-0+deb11u3 and is not vulnerable to [OpenSSL’s CVE-2022-3786 and CVE-2022-3602](https://www.openssl.org/news/secadv/20221101.txt).

More details on the vulnerability can be found at [CVE-2022-3786 and CVE-2022-3602: X.509 Email address buffer overflows | OpenSSL Library](https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/).