security-advisory-0075

This advisory documents the impact of a publicly disclosed vulnerability in OpenSSL on Arista products. There exists a vulnerability in OpenSSL versions 1.0.2, 1.1.1, and 3.0 in which a certificate containing invalid elliptic curve parameters can cause Denial-of-Service (DoS) to the application by triggering an infinite loop. Arista Engineering and Security teams have evaluated the impact of the vulnerability and are diligently working on the fixes. The vulnerability was reported externally by upstream and Arista is not aware of any malicious uses of this issue in customer networks.