CVE-2021-3449

CVE-2021-3449: fallo en OpenSSL

NULL pointer deref in signature_algorithms processing

Publicada el · Actualizada el

15Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 64%
probabilidad de explotación
64%top 1% de las CVE
explotación observada
noninguna fuente lo reporta
Lo que declaran los fabricantes (VEX)

Declaraciones oficiales de los fabricantes en formato CSAF/VEX: si su producto está afectado, ya corregido o descartado — y por qué. Es afirmación del fabricante, no juicio de Vexday.

Red Hatdocumento VEX ↗
Corregido
11 productos (160 componentes)
Red Hat JBoss Core Services on RHEL 7 Server · Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat Enterprise Linux BaseOS EUS (v. 8.1) · Red Hat Enterprise Linux BaseOS EUS (v. 8.2) · Red Hat JBoss Web Server 3.1 for RHEL 7 · y otros 6
corrección ↗
No afectado
6 productos (144 componentes) — porque el código vulnerable no está presente en el producto
Red Hat Virtualization 4 Hypervisor for RHEL 8 · RHEL 8-based RHEV-H for RHEV 4 (build requirements) · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 9 · y otros 1
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).
Productos afectados
OpenSSL · OpenSSL
CVEs relacionadas — OpenSSL

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-2068CRITICALThe c_rehash script allows command injectionEPSS 95.4%CVE-2022-3786HIGHX.509 Email Address Variable Length Buffer OverflowEPSS 92.5%CVE-2022-3602HIGHX.509 Email Address 4-byte Buffer OverflowEPSS 90.8%CVE-2021-3711—SM2 Decryption Buffer OverflowEPSS 87.8%CVE-2022-1292CRITICALThe c_rehash script allows command injectionEPSS 82.6%CVE-2023-2650MEDIUMPossible DoS translating ASN.1 object identifiersEPSS 75.1%
Referencias
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdfhttps://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fb9fa6b51defd48157eeb207f52181f735d96148https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845https://kc.mcafee.com/corporate/index?page=content&id=SB10356https://lists.debian.org/debian-lts-announce/2021/08/msg00029.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.aschttps://security.gentoo.org/glsa/202103-03https://security.netapp.com/advisory/ntap-20210326-0006/https://security.netapp.com/advisory/ntap-20210513-0002/