DSA-5103: -1 openssl -- security update
Published Mar 15, 2022
·Updated
openssl - security update
Other sources
Tavis Ormandy discovered that the BNmodsqrt() function of OpenSSL could be tricked into an infinite loop. This could result in denial of service via malformed certificates.
Affected Software
2 affected components
debian/openssl
debian/openssl
Event History
Mar 15, 2022
Advisory Published
12:00 AM
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
An attacker needs to supply a malformed certificate that causes OpenSSL's BN_mod_sqrt() function to enter an infinite loop.
2
What is the practical impact of successful exploitation?
Successful exploitation can cause a denial of service by making the affected OpenSSL operation loop indefinitely.