21.0.0.SPC1

DTS: DTS2022031614728

Vulnerability ID: HWPSIRT-2022-46709

Condition: During certificate parsing, when a certain algorithm that contains elliptic curve parameters in compressed form is used, it is possible to trigger an infinite loop for non-prime moduli.

Symptom: When a TA invokes the PEM_read_bio_X509 API, an infinite loop occurs in the program under certain conditions, and the API cannot return results.

Impact: The TA is interrupted, affecting service functions.

The product involves a security vulnerability in OpenSSL 1.1.1k. The CVE number is CVE-2022-0778.

Minor

The BN_mod_sqrt function of the open source component (OpenSSL 1.1.1k) has a coding defect, which may cause the function to loop forever for non-prime moduli. This API is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form.

Avoid invoking the PEM_read_bio_X509 API for upper-layer TAs.

The defect is rectified, and no other impact is imposed.

1. After the open source patch for this OpenSSL vulnerability is installed, use the test suite provided by OpenSSL to check whether the vulnerability is fixed.
2. It is confirmed that the patch for this vulnerability has been incorporated into the open source component introduced into this product.