Description
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc).
Published: 2022-03-15
Score: 7.5 High
EPSS: 7.1% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-2952-1 openssl security update
Debian DLA Debian DLA DLA-2953-1 openssl1.0 security update
Debian DSA Debian DSA DSA-5103-1 openssl security update
EUVD EUVD EUVD-2022-1575 The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc).
Github GHSA Github GHSA GHSA-x3mh-jvjw-3xwx openssl-src's infinite loop in `BN_mod_sqrt()` reachable when parsing certificates
Ubuntu USN Ubuntu USN USN-5328-1 OpenSSL vulnerability
Ubuntu USN Ubuntu USN USN-5328-2 OpenSSL vulnerability
Ubuntu USN Ubuntu USN USN-6457-1 Node.js vulnerabilities
Ubuntu USN Ubuntu USN USN-7894-1 EDK II vulnerabilities
References
Link Providers
http://packetstormsecurity.com/files/167344/OpenSSL-1.0.2-1.1.1-3.0-BN_mod_sqrt-Infinite-Loop.html cve-icon cve-icon
http://seclists.org/fulldisclosure/2022/May/33 cve-icon cve-icon
http://seclists.org/fulldisclosure/2022/May/35 cve-icon cve-icon
http://seclists.org/fulldisclosure/2022/May/38 cve-icon cve-icon
https://cert-portal.siemens.com/productcert/html/ssa-019200.html cve-icon
https://cert-portal.siemens.com/productcert/html/ssa-028723.html cve-icon
https://cert-portal.siemens.com/productcert/html/ssa-108696.html cve-icon
https://cert-portal.siemens.com/productcert/html/ssa-398330.html cve-icon
https://cert-portal.siemens.com/productcert/html/ssa-712929.html cve-icon
https://cert-portal.siemens.com/productcert/pdf/ssa-712929.pdf cve-icon cve-icon
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3118eb64934499d93db3230748a452351d1d9a65 cve-icon cve-icon
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=380085481c64de749a6dd25cdf0bcf4360b30f83 cve-icon cve-icon
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=a466912611aa6cbdf550cd10601390e587451246 cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2022/03/msg00023.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2022/03/msg00024.html cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/323SNN6ZX7PRJJWP2BUAFLPUAE42XWLZ/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GDB3GQVJPXJE7X5C5JN6JAA4XUDWD6E6/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6K3PR542DXWLEFFMFIDMME4CWMHJRMG/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-0778 cve-icon
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0002 cve-icon cve-icon
https://security.gentoo.org/glsa/202210-02 cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20220321-0002/ cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20220429-0005/ cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20240621-0006/ cve-icon cve-icon
https://support.apple.com/kb/HT213255 cve-icon cve-icon
https://support.apple.com/kb/HT213256 cve-icon cve-icon
https://support.apple.com/kb/HT213257 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-0778 cve-icon
https://www.debian.org/security/2022/dsa-5103 cve-icon cve-icon
https://www.openssl.org/news/secadv/20220315.txt cve-icon cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuapr2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujul2022.html cve-icon cve-icon
https://www.tenable.com/security/tns-2022-06 cve-icon cve-icon
https://www.tenable.com/security/tns-2022-07 cve-icon cve-icon
https://www.tenable.com/security/tns-2022-08 cve-icon cve-icon
https://www.tenable.com/security/tns-2022-09 cve-icon cve-icon
History

Tue, 14 Apr 2026 10:30:00 +0000

Type Values Removed Values Added
References

Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.06803}

 epss

{'score': 0.06187}

Sun, 08 Sep 2024 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat acm
CPEs cpe:/a:redhat:acm:2.4::el8
cpe:/a:redhat:acm:2.5::el8
Vendors & Products Redhat acm

Mon, 19 Aug 2024 22:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.4::el8
cpe:/a:redhat:acm:2.5::el8
Vendors & Products Redhat acm

Subscriptions

Debian Debian Linux
Fedoraproject Fedora
Mariadb Mariadb
Netapp 500f 500f Firmware A250 A250 Firmware Cloud Volumes Ontap Mediator Clustered Data Ontap Clustered Data Ontap Antivirus Connector Santricity Smi-s Provider Storagegrid
Nodejs Node.js
Openssl Openssl
Redhat Acm Enterprise Linux Jboss Core Services Jboss Enterprise Web Server Rhel Aus Rhel E4s Rhel Els Rhel Eus Rhel Tus Rhev Hypervisor
Tenable Nessus
cve-icon MITRE

Status: PUBLISHED

Assigner: openssl

Published:

Updated: 2026-04-14T08:58:00.706Z

Reserved: 2022-02-28T00:00:00.000Z

Link: CVE-2022-0778

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2022-03-15T17:15:08.513

Modified: 2026-04-14T10:16:21.510

Link: CVE-2022-0778

cve-icon Redhat

Severity : Important

Publid Date: 2022-03-15T00:00:00Z

Links: CVE-2022-0778 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses