Cybersecurity
OpenSSL BN_mod_sqrt infinite-loop DoS (CVE-2022-0778) affects certificate parsing in some Fortinet products
A Fortinet advisory reports CVE-2022-0778, an OpenSSL BN_mod_sqrt() flaw that can hang processes parsing crafted certificates or private keys with invalid elliptic-curve parameters. The issue can cause denial of service in TLS clients, TLS servers, certificate authorities, and other apps that parse external ASN.1 EC data. Defenders should apply vendor patches and restrict untrusted certificate/key ingestion where possible.
Fortinet published a security advisory for an OpenSSL library flaw, CVE-2022-0778, with a CVSSv3 score of 7.5. The bug is in BN_mod_sqrt(), which computes a modular square root. For non-prime moduli, the function can enter an infinite loop.
The function is reached while parsing certificates that contain elliptic-curve public keys in compressed form, or explicit elliptic-curve parameters whose base point is encoded in compressed form. A crafted certificate with invalid explicit curve parameters can trigger the loop before certificate signature verification completes.
Because certificate parsing can occur before signature validation, any process that accepts externally supplied certificates may be exposed to a denial-of-service condition. The same infinite loop can also be triggered by crafted private keys that contain explicit elliptic-curve parameters.
Impacted systems include:
* TLS clients that consume server certificates.
* TLS servers that consume client certificates.
* Hosting providers that accept customer certificates or private keys.
* Certificate authorities that parse certificate requests from subscribers.
* Applications that parse ASN.1 elliptic-curve parameters or call BN_mod_sqrt() with attacker-controlled values.
OpenSSL 1.0.2 is discussed in the advisory: the public key is not parsed during initial certificate parsing, which makes the trigger slightly harder, but operations that require the certificate public key can still cause the loop. A self-signed certificate can trigger it during signature verification.
Mitigation:
* Apply the Fortinet product update or OpenSSL fix supplied by the vendor.
* Restrict ingestion of untrusted certificates and private keys.
Related vulnerabilities
Unified Security for Multi‑Campus Universities: From Siloed to Shared Defense
Higher‑education systems confront a surge in attacks and overlapping compliance mandates, yet campus‑level security remains fragmented. Treating security as a shared capability—leveraging federated architecture and a central platform—gives end‑to‑end visibility, coordinated response, and efficient compliance.
Read briefing
Microsoft Office SharePoint spoofing flaw allows authorized attacker to inject content via web page generation
Microsoft reports CVE-2026-102859, a spoofing vulnerability in Microsoft Office SharePoint caused by insufficient sanitization before web page rendering. The advisory describes it as a cross-site scripting weakness that an authorized attacker can exploit over a network. Defenders should apply vendor fixes, review SharePoint access controls, and monitor authenticated sessions for anomalous rendered content.
Read briefing
Continuous Authorization Challenges in Zero Trust Environments: Practical Steps for SecOps
Zero Trust adoption has exposed gaps in continuous authorization, leading to policy drift and blind spots. CrowdStrike’s Agentic SOC and Falcon platform now provide AI‑driven enforcement to close these gaps. Defenders should enable continuous policy evaluation, integrate with Falcon, and audit authorization flows.
Read briefing
Continuous Authorization: Bridging Zero Trust Gaps
Security teams are struggling to enforce dynamic access controls across modern workloads. This briefing explains the core challenges of continuous authorization, the impact on critical infrastructure, and how to implement practical mitigations with CrowdStrike Falcon and related tooling.
Read briefing