CVE-2022-0778
CVE-2022-0778: 1 tracked advisory record across Fortinet. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Fortinet
1 advisory- Advisory severityHigh7.5
High [CVE-2022-0778] Vulnerability in OpenSSL library
FG-IR-22-059Source published Source updated
CVSSv3 Score: 7.5 A security advisory was released affecting the version of OpenSSL library used in some Fortinet products:CVE-2022-0778:The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite…
- Affected products in this advisory
- FortiOS
- FortiManager
- FortiAnalyzer
- FortiDeceptor
2 more entries in the full advisory.
- Source-reported affected versions
- 1.0.2
- 1.1.1
- Source-reported fixed versions
- 3.0.2
- 3.0.0
- 3.0.1
- 1.1.1-1
1 more entries in the full advisory.
- Mitigation guidance
- Upgrade per the vendor advisory: FortiOS: 6.0.15; FortiOS: 6.2.11; FortiOS: 6.4.9; FortiOS: 7.0.6; FortiOS: 7.2.0; ….
Android app · Google Play
Monitor future Fortinet CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.