Denial of Service Vulnerability in OpenSSL
Summary
CVE-2022-0778: The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Affects openssl across 5 version ranges.
< 1.1.1n-r0
>= 7ea5bd2b52d0e81eaef3d109b3b12545306f201c, < e04bd3433fd84e1861bf258ea37928d9845e6a86
>= 42cce5a9d0fd905bf4ad7a2528c36572dfb8b5ad, < cdb72ea5d913a19ec988c680679de4182239fb18
>= 776555af021e917ce0d6235386b43ae59fdd5161, < 78564373fee5e6cccf144b11bc60b0876b4bbd0b
>= d6863347edda2f07f646eec5c0be251d4b599025, < 7e8696f8926ee5793bc9c73413c572f957af7e9b
Fixed in 1.1.1n-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is an open-source cryptographic library that provides secure communication over computer networks. It is widely used in various applications, including TLS/SSL protocols, certificate management, and cryptographic operations. However, a vulnerability has been discovered in OpenSSL that can lead to a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability, identified as CVE-2022-0778, exists in the BN_mod_sqrt() function of OpenSSL. This function is responsible for computing a modular square root. However, it contains a bug that can cause an infinite loop when processing certificates or private keys with invalid explicit elliptic curve parameters. This vulnerability can be exploited by crafting a certificate or private key with malicious parameters, leading to a DoS attack. The issue affects OpenSSL versions 1.0.2, 1.1.1, and 3.0.
How To Fix
Minimum fixed version
1.1.1n-r0
This is the first release that contains the fix.
sudo apk add --upgrade opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patches or updates provided by OpenSSL.
Conclusion
The OpenSSL vulnerability (CVE-2022-0778) poses a significant risk to systems and applications that utilize OpenSSL for cryptographic operations. To mitigate this risk, it is crucial to update OpenSSL to the latest patched versions. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openssl →
FAQ
The vulnerability can be exploited to launch a denial of service attack, causing affected applications or systems to become unresponsive.
OpenSSL versions 1.0.2, 1.1.1, and 3.0 are affected by this vulnerability.
Yes, this vulnerability can be exploited remotely by sending a crafted certificate or private key to a vulnerable system.
The only known mitigation is to update OpenSSL to the latest patched versions.
There is no evidence of active exploits in the wild at the time of this report.
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
