CVE-2022-0778 is a high-severity vulnerability affecting OpenSSL versions 1.0.2, 1.1.1, and 3.0. It involves a bug in the BN\_mod\_sqrt() function that can cause it to loop indefinitely for non-prime moduli, leading to a denial of service attack. This issue impacts a variety of systems, including TLS clients and servers, hosting providers, certificate authorities, and other applications that use the BN\_mod\_sqrt() function where an attacker can control the parameter values.

How do I know if I'm affected?

If you're using OpenSSL versions 1.0.2, 1.1.1, or 3.0, you might be affected by this vulnerability. This issue is related to a bug in the BN\_mod\_sqrt() function that can cause an infinite loop, leading to a denial of service attack. To check if you're affected, you can look for the specific OpenSSL version you're using. Keep in mind that this vulnerability has been fixed in OpenSSL 1.1.1n and 3.0.2.

What should I do if I'm affected?

If you're affected by the CVE-2022-0778 vulnerability, it's important to update your OpenSSL to a fixed version, such as 1.1.1n or 3.0.2. To do this, check for updates from your software provider or operating system, and follow their instructions to upgrade your OpenSSL package. This will help protect your system from potential denial of service attacks.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2022-0778 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This issue, known as the BN\_mod\_sqrt() function bug in OpenSSL, was added to the National Vulnerability Database on March 15, 2022. To address this vulnerability, users should update their affected OpenSSL versions to the fixed releases (1.1.1n and 3.0.2) or apply patches provided by the vendor for other affected software configurations.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-835, which is an infinite loop issue in OpenSSL's BN\_mod\_sqrt() function. Updating to fixed OpenSSL versions or applying patches can help address this weakness.

For more details

CVE-2022-0778 is a high-severity vulnerability affecting various OpenSSL versions and software configurations. To protect your systems, it's crucial to update to fixed OpenSSL releases or apply vendor-provided patches. For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• OpenSSL 1.0.2 / 1.1.1 / 3.0 BN\_mod\_sqrt() Infinite Loop ≈ Packet Storm

• APPLE-SA-2022-05-16-4 Security Update 2022-004 Catalina

• git.openssl.org Git