CVE-2022-0778 (500f_firmware, a250_firmware, cloud_volumes_ontap_mediator, clustered_data_ontap, clustered_data_ontap_antivirus_connector, debian_linux, fedora, mariadb, nessus, node.js, openssl, santricity_smi-s_provider, storagegrid)

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate …

cve-2022-0778