Researchers from the cybersecurity firm Palo Alto Networks released a warning that some of their products are vulnerable to an OpenSSL bug tracked as CVE-2022-0778. This vulnerability can be exploited to trigger Denial-of-Service (DoS) conditions, and may affect PAN-OS, GlobalProtect applications, and Cortex XDR agent software. This flaw lies within the “BN_mod_sqrt()” function, and stems from maliciously crafted public and private key certificates with explicit elliptic curve parameters. Specifically, this bug affects TLS clients that accept server certificates and client certificates, as well as hosting providers, certificate authorities, and anything else that parses these same elliptic curve parameters. There is a proof-of-concept (PoC) exploit available online, however at this time there is no evidence that this vulnerability has been exploited in-the-wild. OpenSSL has already successfully patched this vulnerability; however, Palo Alto will be releasing their own security patch during the week of April 18th, 2022. Until then, Palo Alto has ensured that their customers have provided mitigations that defend them from this flaw and have programmed Threat IDs 92409 and 92411 to recognize and block attacks. CTIX recommends that Threat Prevention subscribers enable both Threat IDs and ensure that the Palo Alto hotfix is installed as soon as possible. It is vital that operators and administrators are aware of the vulnerabilities impacting the products they manage/maintain, and even if a stable patch is not available, as a best practice they should be exhausting all efforts to find ways to manually harden their environments.