CVE-2021-20257

CVE-2021-20257 concerns QEMU’s e1000 NIC emulator. The issue is an infinite loop in process_tx_desc when tx descriptor fields are invalid, allowing a guest to exhaust host CPU and cause DoS. Connected advisories confirm this affects QEMU and related builds (e.g., Debian LTS, Red Hat/AL2, Astra Li...

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker who controls the HTTP server to make the client script enter an infinite loop consuming CPU time. The highest threat from this vulnerability is to system availability.

...

openssl-src's infinite loop in `BN_mod_sqrt()` reachable when parsing certificates

The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a...

OpenSSL: Infinite loop in BN_mod_sqrt() reachable when parsing certificates (CVE-2022-0778) - Windows

OpenSSL is prone to an infinite loop vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE SLES15 Security Update : openssl-1_1 (SUSE-SU-2022:0851-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0851-1 advisory. - The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli...

Check Point Response to CVE-2022-0778 - possible infinite loop when parsing ECDSA certificates/keys in OpenSSL

Symptoms - A vulnerability was found in OpenSSL, making it possible to trigger an infinite loop by crafting a certificate with invalid explicit curve parameters. Because certificate parsing occurs before verification of the certificate signature, a process that parses an externally supplied...

OpenSSL 3.0.0 < 3.0.2 Vulnerability

The version of OpenSSL installed on the remote host is prior to 3.0.2. It is, therefore, affected by a vulnerability as referenced in the 3.0.2 advisory. - The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internal...

Amazon Linux 2 : openssl, openssl11 (ALAS-2022-1766)

The version of openssl installed on the remote host is prior to 1.0.2k-24. The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1766 advisory. The BNmodsqrt function, which computes a modular...

FreeBSD : OpenSSL -- Infinite loop in BN_mod_sqrt parsing certificates (ea05c456-a4fd-11ec-90de-1c697aa5a594)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ea05c456-a4fd-11ec-90de-1c697aa5a594 advisory. - The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loo...

OpenSSL: Infinite loop in BN_mod_sqrt() reachable when parsing certificates (CVE-2022-0778) - Linux

OpenSSL is prone to an infinite loop vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE-SU-2022:0860-1 Security update for openssl-1_1

This update for openssl-11 fixes the following issues: Security issue fixed: - CVE-2022-0778: Infinite loop in BNmodsqrt reachable when parsing certificates bsc1196877. Non-security issues fixed: - Fix PAC pointer authentication in ARM. bsc1195856 - Pull libopenssl-11 when updating openssl-11 wit...

SUSE-SU-2022:0859-1 Security update for compat-openssl098

This update for compat-openssl098 fixes the following issues: - CVE-2022-0778: Infinite loop in BNmodsqrt reachable when parsing certificates bsc1196877...

SUSE-SU-2022:14916-1 Security update for openssl1

This update for openssl1 fixes the following issues: - CVE-2022-0778: Fixed an infinite loop in BNmodsqrt reachable when parsing certificates bsc1196877...

SUSE-SU-2022:0856-1 Security update for openssl-1_0_0

This update for openssl-100 fixes the following issues: - CVE-2022-0778: Infinite loop in BNmodsqrt reachable when parsing certificates bsc1196877...

OPENSUSE-SU-2022:0856-1 Security update for openssl-1_0_0

This update for openssl-100 fixes the following issues: - CVE-2022-0778: Infinite loop in BNmodsqrt reachable when parsing certificates bsc1196877...

SUSE-SU-2022:14915-1 Security update for openssl

This update for openssl fixes the following issues: - CVE-2022-0778: Infinite loop in BNmodsqrt reachable when parsing certificates bsc1196877...

SUSE-SU-2022:0854-1 Security update for openssl

This update for openssl fixes the following issues: - CVE-2022-0778: Infinite loop in BNmodsqrt reachable when parsing certificates bsc1196877...

SUSE-SU-2022:0853-1 Security update for openssl-1_1

This update for openssl-11 fixes the following issues: - CVE-2022-0778: Infinite loop in BNmodsqrt reachable when parsing certificates bsc1196877...

SUSE-SU-2022:0851-1 Security update for openssl-1_1

This update for openssl-11 fixes the following issues: - CVE-2022-0778: Infinite loop in BNmodsqrt reachable when parsing certificates bsc1196877. - Add safe primes to DH parameter generation as recommended from RFC7919 and RFC3526 bsc1180995...

CVE-2022-0778

A flaw was found in OpenSSL. It is possible to trigger an infinite loop by crafting a certificate that has invalid elliptic curve parameters. Since certificate parsing happens before verification of the certificate signature, any process that parses an externally supplied certificate may be subje...