CVE-2021-3449

Katalog CVE

CVSS 5.9 · Medium EPSS 63,5%

Kerentanan NULL Pointer Dereference pada openssl, debian linux +36 lainnya. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).

Rincian

Terbit di NVD

25 Maret 2021

Terakhir diubah

8 Oktober 2026

Status NVD

Modified

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference

EPSS (30 hari)

63,5% peluang dieksploitasi; lebih tinggi dari 99,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 142 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://www.openssl.org/news/secadv/20210325.txt advisory vendor
• https://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf patch · advisory pihak ketiga
• https://www.oracle.com//security-alerts/cpujul2021.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuApr2021.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/03/27/1 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/03/27/2 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/03/28/3 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/03/28/4 mailing list · advisory pihak ketiga
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf advisory pihak ketiga
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845 advisory pihak ketiga
• https://kc.mcafee.com/corporate/index?page=content&id=SB10356 advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/08/msg00029.html mailing list · advisory pihak ketiga
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013 advisory pihak ketiga
• https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc advisory pihak ketiga
• https://security.gentoo.org/glsa/202103-03 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210326-0006/ advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210513-0002/ advisory pihak ketiga
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-4875 advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujul2022.html advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuoct2021.html advisory pihak ketiga
• https://www.tenable.com/security/tns-2021-05 advisory pihak ketiga
• https://www.tenable.com/security/tns-2021-06 advisory pihak ketiga
• https://www.tenable.com/security/tns-2021-09 advisory pihak ketiga