Palo Alto Networks devices affected by CVE-2022
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-0778 | The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc). NVD description · AI analysis pending | 7.5 | 73% |
| — |
Full article525 words · extracted from securityaffairs.com · click to collapse
Palo Alto Networks plans to fix CVE-2022-0778 OpenSSL flaw in some of its firewall, VPN, and XDR, products during April 2022.
In Mid March, OpenSSL released updates to address a high-severity denial-of-service (DoS) vulnerability, tracked as CVE-2022-0778, that affects the BN_mod_sqrt() function used when certificate parsing. The flaw was discovered by the popular Google Project Zero researcher Tavis Ormandy.
An attacker can trigger the vulnerability by crafting a malformed certificate with invalid explicit curve parameters.
“The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form.” reads the advisory for this flaw. “It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters.”
The vulnerability impacts OpenSSL versions 1.0.2, 1.1.1 and 3.0, the maintainers of the project addressed the flaw with the release of versions 1.0.2zd (for premium support customers), 1.1.1n and 3.0.2.
Palo Alto Networks warns that an attacker can trigger the vulnerability to cause the OpenSSL library to enter an infinite loop when parsing an invalid certificate and can result in a DoS condition.
“All PAN-OS software updates for this issue are expected to be released in April 2022. The full fixed versions for PAN-OS hotfixes will be updated in this advisory as soon as they are available.” states Palo Alto Network.
The company is expected to release security fixes for the above vulnerability during the week of April 18.
According to Palo Alto, PAN-OS, GlobalProtect app, and Cortex XDR agent software contain a flawed version of the OpenSSL library, while Prisma Cloud and Cortex XSOAR solutions are not impacted.
Below is the product status shared by Palo Alto Networks:
| Versions | Affected | Unaffected |
|---|---|---|
| Cortex XDR Agent | all | |
| Cortex XSOAR | None | all |
| GlobalProtect App | all | |
| PAN-OS 10.2 | < 10.2.1 | >= 10.2.1 |
| PAN-OS 10.1 | < 10.1.5-hf | >= 10.1.5-hf |
| PAN-OS 10.0 | < 10.0.10 | >= 10.0.10 |
| PAN-OS 9.1 | < 9.1.13-hf | >= 9.1.13-hf |
| PAN-OS 9.0 | < 9.0.16-hf | >= 9.0.16-hf |
| PAN-OS 8.1 | < 8.1.23 | >= 8.1.23 |
| Prisma Access 3.0 | Preferred, Innovation | |
| Prisma Access 2.2 | Preferred | |
| Prisma Access 2.1 | Preferred, Innovation | |
| Prisma Cloud | None | all |
“We intend to fix this issue in the following releases: PAN-OS 8.1.23, PAN-OS 9.0.16-hf, PAN-OS 9.1.13-hf, PAN-OS 10.0.10, PAN-OS 10.1.5-hf, PAN-OS 10.2.1, and all later PAN-OS versions. These updates are expected to be available during the week of April 18, 2022.” continues the advisory.
Waiting for PAN-OS security patches, the vendor states that customers with Threat Prevention subscriptions can enable Threat IDs 92409 and 92411 to reduce the risk of exploitation for this issue.
Please vote for Security Affairs as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections “The Underdogs – Best Personal (non-commercial) Security Blog” and “The Tech Whizz – Best Technical Blog” and others of your choice.
To nominate, please visit: https://docs.google.com/forms/d/e/1FAIpQLSfxxrxICiMZ9QM9iiPuMQIC-IoM-NpQMOsFZnJXrBQRYJGCOw/viewform
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, cybercrime)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/129935/hacking/palo-alto-networks-devices-openssl-flaws.html