chore: add advisory regarding openssl3 vulnerabilities

docs/src/security-responses/2022-11-01_openssl.md

@@ -0,0 +1,26 @@
+# 2022-11-01 - Critical OpenSSL Vulnerability
+
+Last updated: 2022-11-01
+
+## Introduction
+OpenSSL in versions after 3 and before 3.0.7 are potentially vulnerable against CVE-2022-3786 and CVE-2022-3602.
+
+In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.
+Wire applications perform such requests to TLS servers and Wire-Servers also accepts
+
+## Are Wire installations affected?
+
+**Wire/wire-server (<= 2022-10-04) is not affected by this vulnerability.** Neither Wire-server on the cloud (on wire.com) nor on-premise installations are affected.
+
+Only OpenSSL prior to version 3 is affected, all wire-server components use OpenSSL 1.1.1.
+
+## Are Wire clients affected?
+
+**Wire clients are not affected by this vulnerability.**
+
+Wire clients for **Android** (<= 3.82.38) and **iOS** (<= 3.106) and don’t use OpenSSL. These Wire clients use only libsodium for cryptographic operations.
+
+The Wire **Webapp** (<= 2022.10.12.08.31) and **Desktop** (<= 3.29) clients make use of OpenSSL 1.1.1 but not OpenSSL 3.
+
+## Further information
+* Additional details can be found in the [Security Advisory of OpenSSL](https://www.openssl.org/news/secadv/20221101.txt)