openssl security update

1.0.2k-24.0.3 - fix CVE-2022-0778 - possible infinite loop in BNmodsqrt...

CLSA-2022-1647550603 Fix CVE(s): CVE-2022-0778

SECURITY UPDATE: Infinite loop in BNmodsqrt - debian/patches/CVE-2022-0778.patch: fix infinite loop in crypto/bn/bnsqrt.c. - CVE-2022-0778...

Fix of CVE: CVE-2022-0778

CVE-2022-0778: Fix possible infinite loop in BNmodsqrt...

CLSA-2022-1647550273 Fix of CVE: CVE-2022-0778

CVE-2022-0778: Fix possible infinite loop in BNmodsqrt...

[slackware-security] openssl

New openssl packages are available for Slackware 14.2, 15.0, and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/openssl-1.1.1n-i586-1slack15.0.txz: Upgraded. This update fixes a high severity security issue: The BNmodsqrt function, which...

OpenSSL exposed to Denial-of-service vulnerability causing Infinite Loop

THREAT LEVEL: Amber. For a detailed advisory, download the pdf file here. A security flaw exists in OpenSSL software library that could lead to a denial-of-service DoS condition when parsing certificates. The vulnerability, identified as CVE-2022-0778, arises from parsing a malformed certificate...

[SECURITY] [DLA 2953-1] openssl1.0 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2953-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort March 17, 2022 https://wiki.debian.org/LTS -...

SUSE SLES12: libopenssl-1_1-devel / libopenssl-1_1-devel-32bit / libopenssl1_1 / etc (SUSE-SU-2022:0860-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0860-1 advisory. Security issue fixed: - CVE-2022-0778: Infinite loop in BNmodsqrt reachable when parsing certificates bsc1196877. Non-security issues fixed:...

Debian DLA-2952-1 : openssl - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2952 advisory. - There is an overflow bug in the x6464 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests...

SUSE SLES11: libopenssl-devel / libopenssl0_9_8 / libopenssl0_9_8-32bit / etc (SUSE-SU-2022:14915-1)

The remote SUSE Linux SLES11 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2022:14915-1 advisory. - CVE-2022-0778: Infinite loop in BNmodsqrt reachable when parsing certificates bsc1196877. Tenable has extracted the preceding description block...

Debian DLA-2953-1 : openssl1.0 - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2953 advisory. Tavis Ormandy discovered that the BNmodsqrt function of OpenSSL could be tricked into an infinite loop. This could result in denial of service via malformed certificates. F...

SUSE SLES12: libopenssl-1_0_0-devel / libopenssl-1_0_0-devel-32bit / etc (SUSE-SU-2022:0857-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0857-1 advisory. - CVE-2022-0778: Infinite loop in BNmodsqrt reachable when parsing certificates bsc1196877. - Allow CRYPTOTHREADIDsetcallback to be called...

New Infinite Loop Bug in OpenSSL Could Let Attackers Crash Remote Servers

The maintainers of OpenSSL have shipped patches to resolve a high-severity security flaw in its software library that could lead to a denial-of-service DoS condition when parsing certificates. Tracked as CVE-2022-0778 CVSS score: 7.5, the issue stems from parsing a malformed certificate with...

roaring-landmask (=0.4.0) potentially affected by CVE-2022-0778 via openssl-src (=300.0.0+3.0.0)

openssl-src CARGO version =300.0.0+3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - roaring-landmask =0.4.0 Source cves: CVE-2022-0778 Source advisory: OSV:GHSA-X3MH-JVJW-3XWX...

openssl-sys (>=0.9.35 <=0.9.37) potentially affected by CVE-2022-0778 via openssl-src (=110.0.7+1.1.0i)

openssl-src CARGO version =110.0.7+1.1.0i is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - openssl-sys =0.9.35, =0.9.37 Source cves: CVE-2022-0778 Source advisory: OSV:GHSA-X3MH-JVJW-3XWX...

SUSE SLES15 Security Update : openssl-1_0_0 (SUSE-SU-2022:0856-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0856-1 advisory. - The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli...

SUSE SLES12 Security Update : compat-openssl098 (SUSE-SU-2022:0859-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0859-1 advisory. - The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli...

Amazon Linux AMI : openssl (ALAS-2022-1575)

The version of openssl installed on the remote host is prior to 1.0.2k-16.156. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1575 advisory. The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime...

Check Point Response to CVE-2022-0778 - possible infinite loop when parsing ECDSA certificates/keys in OpenSSL

Symptoms - A vulnerability was found in OpenSSL, making it possible to trigger an infinite loop by crafting a certificate with invalid explicit curve parameters. Because certificate parsing occurs before verification of the certificate signature, a process that parses an externally supplied...

FreeBSD : OpenSSL -- Infinite loop in BN_mod_sqrt parsing certificates (ea05c456-a4fd-11ec-90de-1c697aa5a594)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ea05c456-a4fd-11ec-90de-1c697aa5a594 advisory. - The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loo...