Oracle Linux 7 : openssl (ELSA-2022-9224)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9224 advisory. 1.0.2k-24.0.3 - fix CVE-2022-0778 - possible infinite loop in BNmodsqrt Tenable has extracted the preceding description block directly from the Oracle Linux...

Node.js 12.x < 12.22.11, 14.x < 14.19.1, 16.x < 16.14.2, 17.x < 17.7.2 DoS Vulnerability - Windows

Node.js is prone to a denial of service DoS vulnerability in OpenSSL. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

openssl security update

1.0.2k-24.0.3 - fix CVE-2022-0778 - possible infinite loop in BNmodsqrt...

Oracle Linux 7 : openssl (ELSA-2022-9225)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9225 advisory. - fix CVE-2022-0778 openssl: Fix possible infinite loop in BNmodsqrt Tenable has extracted the preceding description block directly from the Oracle Linux securi...

Oracle Linux 7 : openssl (ELSA-2022-9237)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9237 advisory. 1.0.2k-24.0.3 - fix CVE-2022-0778 - possible infinite loop in BNmodsqrt Tenable has extracted the preceding description block directly from the Oracle Linux...

CLSA-2022-1647550603 Fix CVE(s): CVE-2022-0778

SECURITY UPDATE: Infinite loop in BNmodsqrt - debian/patches/CVE-2022-0778.patch: fix infinite loop in crypto/bn/bnsqrt.c. - CVE-2022-0778...

Fix of CVE: CVE-2022-0778

CVE-2022-0778: Fix possible infinite loop in BNmodsqrt...

CLSA-2022-1647550273 Fix of CVE: CVE-2022-0778

CVE-2022-0778: Fix possible infinite loop in BNmodsqrt...

[slackware-security] openssl

New openssl packages are available for Slackware 14.2, 15.0, and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/openssl-1.1.1n-i586-1slack15.0.txz: Upgraded. This update fixes a high severity security issue: The BNmodsqrt function, which...

OpenSSL exposed to Denial-of-service vulnerability causing Infinite Loop

THREAT LEVEL: Amber. For a detailed advisory, download the pdf file here. A security flaw exists in OpenSSL software library that could lead to a denial-of-service DoS condition when parsing certificates. The vulnerability, identified as CVE-2022-0778, arises from parsing a malformed certificate...

[SECURITY] [DLA 2953-1] openssl1.0 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2953-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort March 17, 2022 https://wiki.debian.org/LTS -...

Debian DLA-2952-1 : openssl - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2952 advisory. - There is an overflow bug in the x6464 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests...

SUSE SLES12: libopenssl-1_0_0-devel / libopenssl-1_0_0-devel-32bit / etc (SUSE-SU-2022:0857-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0857-1 advisory. - CVE-2022-0778: Infinite loop in BNmodsqrt reachable when parsing certificates bsc1196877. - Allow CRYPTOTHREADIDsetcallback to be called...

SUSE SLES11: libopenssl-devel / libopenssl0_9_8 / libopenssl0_9_8-32bit / etc (SUSE-SU-2022:14915-1)

The remote SUSE Linux SLES11 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2022:14915-1 advisory. - CVE-2022-0778: Infinite loop in BNmodsqrt reachable when parsing certificates bsc1196877. Tenable has extracted the preceding description block...

SUSE SLES12: libopenssl-1_1-devel / libopenssl-1_1-devel-32bit / libopenssl1_1 / etc (SUSE-SU-2022:0860-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0860-1 advisory. Security issue fixed: - CVE-2022-0778: Infinite loop in BNmodsqrt reachable when parsing certificates bsc1196877. Non-security issues fixed:...

Debian DLA-2953-1 : openssl1.0 - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2953 advisory. Tavis Ormandy discovered that the BNmodsqrt function of OpenSSL could be tricked into an infinite loop. This could result in denial of service via malformed certificates. F...

New Infinite Loop Bug in OpenSSL Could Let Attackers Crash Remote Servers

The maintainers of OpenSSL have shipped patches to resolve a high-severity security flaw in its software library that could lead to a denial-of-service DoS condition when parsing certificates. Tracked as CVE-2022-0778 CVSS score: 7.5, the issue stems from parsing a malformed certificate with...

roaring-landmask (0.4.0) potentially affected by CVE-2022-0778 via openssl-src (300.0.0+3.0.0)

openssl-src CARGO version 300.0.0+3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - roaring-landmask 0.4.0 Source cves: CVE-2022-0778 Source advisory: OSV:GHSA-X3MH-JVJW-3XWX...

Check Point Response to CVE-2022-0778 - possible infinite loop when parsing ECDSA certificates/keys in OpenSSL

Symptoms - A vulnerability was found in OpenSSL, making it possible to trigger an infinite loop by crafting a certificate with invalid explicit curve parameters. Because certificate parsing occurs before verification of the certificate signature, a process that parses an externally supplied...

Important: openssl, openssl11

Issue Overview: The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve...