A security hole has been found in OpenSSL, which has now been addressed with a fix. The discovered vulnerability, if exploited, might result in a service outage causing the exposed server to crash.
OpenSSL has issued a security update to address a flaw in its library, which, if exploited, would result in Denial of Service (DoS) conditions and remote server crashes.
Finding such a vulnerability within OpenSSL is a severe issue, primarily as OpenSSL is one of the most well-known open-source encryption systems used to secure SSL/TLS (Secure Socket Layer and Transport Layer Security) communications for online platforms’ certification and encrypted conversation. As a result, any flaw in the library has a significant impact.
The problem encountered in OpenSSL
The problem represented as CVE-2022-0778 (CVSS score: 7.5) is a flaw in the analysis of certificates with invalid elliptic curve explicit parameters and would reside in a function called “BN_mod_sqrt.” The function is often used to compute square roots modulo n within the certificate analysis phases.
Calling this function from an unsanctioned channel may result in an infinite loop when processing roots with non-prime modules, resulting in a Denial of Service. Any other program that uses this function and allows a potential attacker to check parameter values would be susceptible to the same issue.
“The BN_mod_sqrt() function, which calculates a modular square root, has a flaw that can cause a loop in non-prime modules. This function is utilized when interpreting certificates with elliptic curve public keys […]. It’s easy to generate a certificate with bogus explicit curve parameters that will activate the infinite loop. “According to an OpenSSL security advisory dated March 15th,”
OpenSSL
Creating an invalid explicit curve parameter certificate that would trigger the infinite loop is possible.
OpenSSL versions 1.0.2, 1.1.1, and 3.0 are susceptible to a severe vulnerability allowing attackers to modify or create arbitrary certificates under specific conditions.
Possible attack scenarios
Although there is no evidence that the vulnerability was exploited in practice, as confirmed by CSIRT Italy there are several cases in which it might still be utilized, such as:
- When TLS clients or servers exchange certificates, this is known as certificate reciprocity.
- When hosting providers obtain client certificates or private keys, it’s called certificate theft.
- When certification authorities examine subscriber certification requests,
- The elliptic curve ASN.1 parameters go through careful analysis in all situations.
The discovery and fix of the bug
While Google Project Zero security researcher Tavis Ormandy was credited for discovering the vulnerability, Google experts David Benjamin and OpenSSL’s Tomáš Mráz were responsible for remedying it.
Unfortunately, the CVE-2022-0778 flaw is not OpenSSL’s first problem this year. A moderate severity vulnerability CVE-2021-4160 (CVSS score of 5.9) was resolved in January, affecting the library’s MIPS32 and MIPS64 squaring methods.
OpenSSL takes the security measures
The vulnerability was discovered in OpenSSL version 1.0.2zd (for premium support only), 1.1.1n, and 3.0.2 (excluding all versions before 1.1.1, which are no longer supported).
The library developers are urging users of the latest version to upgrade to OpenSSL 3.0 or 1.1.1. It is therefore advisable to regularly update individual projects as soon as possible with the security patches provided by the vendors, reported on their official pages.
Share this article
About the Author
Waqas is a cybersecurity journalist and writer who has a knack for writing technology and online privacy-focused articles. He strives to help achieve a secure online environment and is skilled in writing topics related to cybersecurity, AI, DevOps, Cloud security, and a lot more. As seen in: Computer.org, Nordic APIs, Infosecinstitute.com, Tripwire.com, and VentureBeat.
More from Iam WaqasRelated Posts
13 Mobile Security Threats And How To Prevent Them
With the advent of smartphones, mobile devices have slowly become an integral part of our lives. Mob...
Top Fake Security Alerts Cost Mac User Big Bucks & Identity Theft
Macs are secure compared to Windows devices. But it is a great misconception that Mac users don̵...
How to Stop Someone From Spying on My Cell Phone
Spyware is a cell phone that has become a common issue these days. But thinking about it too much or...
3 Ways Data Encryption Protects Your Devices
When the COVID-19 pandemic began, cases of cybercrime exploded, and it’s only getting worse. W...
How Can Your USB Device Pose Security Risks to You
A Universal Serial Bus – USB device is a helpful external data storage device. It includes a f...
How to Tell if Your Phone Has Been Hacked | 12 Signs
With the changing security landscape, smartphones have become more of a curse than a blessing. Mobil...
