CVE-2021-3449

CVE-2021-3449: falha em OpenSSL

NULL pointer deref in signature_algorithms processing

Publicada em · Atualizada em

15Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 64%
probabilidade de exploração
64%top 1% das CVEs
exploração observada
nãonenhuma fonte reporta
O que os fabricantes declaram (VEX)

Declarações oficiais dos fabricantes em formato CSAF/VEX: se o produto deles está afetado, já corrigido ou descartado — e por quê. É afirmação do fabricante, não juízo do Vexday.

Red Hatdocumento VEX ↗
Corrigido
11 produtos (160 componentes)
Red Hat JBoss Core Services on RHEL 7 Server · Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat Enterprise Linux BaseOS EUS (v. 8.1) · Red Hat Enterprise Linux BaseOS EUS (v. 8.2) · Red Hat JBoss Web Server 3.1 for RHEL 7 · e outros 6
correção ↗
Não afetado
6 produtos (144 componentes) — porque o código vulnerável não está presente no produto
Red Hat Virtualization 4 Hypervisor for RHEL 8 · RHEL 8-based RHEV-H for RHEV 4 (build requirements) · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 9 · e outros 1
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).
Produtos afetados
OpenSSL · OpenSSL
CVEs relacionadas — OpenSSL

No mesmo produto, das mais perigosas para as menos.

CVE-2022-2068CRITICALThe c_rehash script allows command injectionEPSS 95.4%CVE-2022-3786HIGHX.509 Email Address Variable Length Buffer OverflowEPSS 92.5%CVE-2022-3602HIGHX.509 Email Address 4-byte Buffer OverflowEPSS 90.8%CVE-2021-3711—SM2 Decryption Buffer OverflowEPSS 87.8%CVE-2022-1292CRITICALThe c_rehash script allows command injectionEPSS 82.6%CVE-2023-2650MEDIUMPossible DoS translating ASN.1 object identifiersEPSS 75.1%
Referências
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdfhttps://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fb9fa6b51defd48157eeb207f52181f735d96148https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845https://kc.mcafee.com/corporate/index?page=content&id=SB10356https://lists.debian.org/debian-lts-announce/2021/08/msg00029.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.aschttps://security.gentoo.org/glsa/202103-03https://security.netapp.com/advisory/ntap-20210326-0006/https://security.netapp.com/advisory/ntap-20210513-0002/