3 ms·
Is BoringSSL affected?
by vinkabuki 5y ago
Is BoringSSL affected?
- DannyBee 5y agoNot to the same degree. See: https://github.com/google/boringssl/commit/c7a3c46574e7fc32357b2cc68f961c56c72b0ca4 https://github.com/google/boringssl/commit/c7a3c46574e7fc323... In particular: " In OpenSSL, this loop resulted in a DoS vulnerability, CVE-2022-0778. BoringSSL is mostly unaffected by this. In particular, this case is not reachable in BoringSSL from certificate and other ASN.1 elliptic curve parsing code. Any impact in BoringSSL is limited to: - Callers of EC_GROUP_new_curve_GFp that take untrusted curve parameters - Callers of BN_mod_sqrt that take untrusted moduli"