RHSA-2022:1071: Important: openssl security update
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.Security Fix(es): openssl: Infinite loop in BNmodsqrt() reachable when parsing certificates (CVE-2022-0778) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2022:1071?
The severity of RHSA-2022:1071 is classified as important due to the potential for an infinite loop in BN_mod_sqrt() when parsing certificates.
How do I fix RHSA-2022:1071?
To fix RHSA-2022:1071, update the OpenSSL package to version 1.1.1g-16.el8_4 or later.
What does RHSA-2022:1071 affect?
RHSA-2022:1071 affects the OpenSSL packages including openssl, openssl-libs, and openssl-devel among others on RHEL 8.4 systems.
What are the potential risks of not addressing RHSA-2022:1071?
Not addressing RHSA-2022:1071 may lead to security vulnerabilities, specifically the possibility of denial of service through infinite loops during certificate parsing.
Is there a workaround for RHSA-2022:1071?
There are no official workarounds for RHSA-2022:1071; updating the affected packages is the recommended action.