QID 38837

Date Published: 2021-03-26

QID 38837: OpenSSL Security Update (OpenSSL Security Advisory 20210325)

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue.

Affected Versions:
OpenSSL version 1.1.1-1.1.1j

NOTE:
OpenSSL 1.1.0 is out of support and no longer receiving updates of any kind. The impact of these issues on OpenSSL 1.1.0 has not been analysed.
OpenSSL 1.0.2 is not impacted by this issue.
QID Detection Logic:(Unauthenticated)
This QID matches vulnerable versions based on the exposed banner information.

Successful exploitation of the vulnerability enables untrusted users to modify OpenSSL's default configuration, insert CA certificates, modify (or even replace) existing engine modules, etc.

CVSS V3 rated as High - 7.4 severity.

CVSS V2 rated as Medium - 5.8 severity.

Solution

The vendor has released a patch. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).For more information please visit advisory.

Vendor References

OpenSSL Security Advisory 20210325 - www.openssl.org/news/secadv/20210325.txt

CVEs related to QID 38837

CVE-2021-3449 | CVE-2021-3450 |

Software Advisories

Advisory ID	Software	Component	Link
20210325			www.openssl.org/news/secadv/20210325.txt

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].