onyx --cves cve-2022-0778
CVE-2022-0778
- score
- <0.1
- cvss
- 7.5
- epss
- 73.2%
- published
- 2022-03-15
- kev added
- —
- first seen
OpenSSL versions 1.0.2, 1.1.1, and 3.0.0-3.0.1 contain a bug in BN_mod_sqrt() causing infinite loops for non-prime moduli during elliptic curve parameter parsing, leading to potential denial of service, exploit requires processing crafted certificates or keys.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
- Public PoC http://packetstormsecurity.com/files/167344/OpenSSL-1.0.2-1.1.1-3.0-BN_mod_sqrt-Infinite-Loop.html
Exploit availability
Weaknesses
References 34
- https://www.tenable.com/security/tns-2022-09
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=a466912611aa6cbdf550cd10601390e587451246
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GDB3GQVJPXJE7X5C5JN6JAA4XUDWD6E6/
- http://seclists.org/fulldisclosure/2022/May/38
- https://security.netapp.com/advisory/ntap-20220321-0002/
- https://www.tenable.com/security/tns-2022-08
- https://cert-portal.siemens.com/productcert/html/ssa-028723.html
- https://cert-portal.siemens.com/productcert/html/ssa-108696.html
- http://packetstormsecurity.com/files/167344/OpenSSL-1.0.2-1.1.1-3.0-BN_mod_sqrt-Infinite-Loop.html
- https://security.netapp.com/advisory/ntap-20220429-0005/
- https://www.debian.org/security/2022/dsa-5103
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.tenable.com/security/tns-2022-07
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- http://seclists.org/fulldisclosure/2022/May/33
- https://support.apple.com/kb/HT213257
- https://cert-portal.siemens.com/productcert/html/ssa-712929.html
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3118eb64934499d93db3230748a452351d1d9a65
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=380085481c64de749a6dd25cdf0bcf4360b30f83
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6K3PR542DXWLEFFMFIDMME4CWMHJRMG/
- https://support.apple.com/kb/HT213255
- https://support.apple.com/kb/HT213256
- https://lists.debian.org/debian-lts-announce/2022/03/msg00024.html
- https://security.gentoo.org/glsa/202210-02
9 more
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-712929.pdf
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/323SNN6ZX7PRJJWP2BUAFLPUAE42XWLZ/
- https://cert-portal.siemens.com/productcert/html/ssa-019200.html
- https://www.openssl.org/news/secadv/20220315.txt
- http://seclists.org/fulldisclosure/2022/May/35
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0002
- https://lists.debian.org/debian-lts-announce/2022/03/msg00023.html
- https://www.tenable.com/security/tns-2022-06