Patchfirst
Patchfirst
CVE-2021-3449 Public exploit EPSS 63.5%

NULL pointer deref in signature_algorithms processing

OpenSSL · OpenSSL

Summary

A NULL pointer dereference in OpenSSL's signature_algorithms processing lets a TLS server be crashed by a maliciously crafted renegotiation ClientHello. An attacker needs only to send that message to a server running TLSv1.2 with renegotiation enabled (the default configuration), with no authentication or user interaction required; OpenSSL TLS clients are not affected.

Official description · CVE.org

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).

Breakdown
26.4 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Public exploit code (PoC-in-GitHub) appeared 1 day after disclosure. No confirmed exploitation is recorded.

  1. Disclosedday 0
  2. Public exploit codePoC-in-GitHub+1 day

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: openssl-src.

Cargoopenssl-srcGHSA-83mx-573x-5rw9RUSTSEC-2021-0055

Upgrade to 111.25.0 or later

Fixes this CVE and 3 other known vulnerabilities in this package (CVE-2021-3711, CVE-2022-0778, +1).

Cargocargo update -p openssl-src --precise 111.25.0

First fixed in 111.15.0 for CVE-2021-3449.

Affected versions

If you runUpgrade to
All versions before 111.15.0111.25.0first fix for this CVE: 111.15.0

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 4 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

29 links, grouped by NVD tag

Other 20

openssl.org/news/secadv/20210325.txtgit.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fb9fa6b51defd48157eeb207f52181f735d96148oracle.com/security-alerts/cpuApr2021.htmltenable.com/security/tns-2021-10tenable.com/security/tns-2021-09security.netapp.com/advisory/ntap-20210513-0002/security.netapp.com/advisory/ntap-20210326-0006/security.freebsd.org/advisories/FreeBSD-SA-21:07.openssl.asc
Show 12 moreShow fewertenable.com/security/tns-2021-06tenable.com/security/tns-2021-05kc.mcafee.com/corporate/index?page=content&id=SB10356oracle.com//security-alerts/cpujul2021.htmlcert-portal.siemens.com/productcert/pdf/ssa-772220.pdfkb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013oracle.com/security-alerts/cpuoct2021.htmloracle.com/security-alerts/cpuapr2022.htmlcert-portal.siemens.com/productcert/pdf/ssa-389290.pdforacle.com/security-alerts/cpujul2022.htmlsecurity.netapp.com/advisory/ntap-20240621-0006/

vendor-advisory 4

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJddebian.org/security/2021/dsa-4875security.gentoo.org/glsa/202103-03lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/

mailing-list 5

openwall.com/lists/oss-security/2021/03/27/1openwall.com/lists/oss-security/2021/03/27/2openwall.com/lists/oss-security/2021/03/28/3openwall.com/lists/oss-security/2021/03/28/4lists.debian.org/debian-lts-announce/2021/08/msg00029.html
↑ ↓ chooseEnter openEsc close