ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2022-0778

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli.

Published Mar 15, 2022 · catalog updated Oct 14, 2026 · Fortinet

Check this week

CVE-2022-0778 is not in CISA KEV. FIRST estimates a 73.19% chance of exploitation in the next 30 days. Check whether you run Fortinet.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
73.19%
Remediation
Advisory link
Affected products
cpe debian/debian linux · cpe fedoraproject/fedora · cpe netapp/500f firmware · cpe netapp/a250 firmware · cpe netapp/cloud volumes ontap mediator · cpe netapp/clustered data ontap

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc).

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe debian/debian linux10.0
  • cpe debian/debian linux11.0
  • cpe debian/debian linux9.0
  • cpe fedoraproject/fedora34
  • cpe netapp/500f firmwareversion unspecified
  • cpe netapp/a250 firmwareversion unspecified
  • cpe netapp/cloud volumes ontap mediatorversion unspecified
  • cpe netapp/clustered data ontapversion unspecified
  • cpe openssl/opensslversion unspecified
  • cpe tenable/nessusversion unspecified

How to fix CVE-2022-0778

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2022-0778 is not in CISA KEV. FIRST estimates a 73.19% chance of exploitation in the next 30 days. Check whether you run Fortinet.

Which versions are affected?

Compare what you have installed with debian/debian linux 10.0; debian/debian linux 11.0; debian/debian linux 9.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-835: Infinite Loop. EPSS 73.19%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Fortinet security

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 15, 2022 · NIST NVD

    Detected

    The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a cer

  2. Oct 14, 2026 · NIST NVD

    Updated

    The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a cer

Sources

  • CVE.orgVulnerability recordCVE-2022-0778

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2022-0778

    30-day exploitation probability 73.2%

    first.org
  • Fortinet PSIRTVendor advisoryCVE-2022-0778

    CVSSv3 Score: 7.5 A security advisory was released affecting the version of OpenSSL library used in some Fortinet products:CVE-2022-0778:The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Intern

    fortiguard.fortinet.com
  • NIST NVDVulnerability recordCVE-2022-0778

    The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curv

    nvd.nist.gov
  • Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/167344/OpenSSL-1.0.2-1.1.1-3.0-BN_mod_sqrt-Infinite-Loop.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References

Freshness

Last verified in this catalog Oct 15, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.