QID 38855

Date Published: 2021-12-10

QID 38855: Open Secure Sockets Layer (OpenSSL) Security Update (OpenSSL Security Advisory 20210824)

An OpenSSL TLS server In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter..

Affected Versions:
OpenSSL version 1.1.1k and below

QID Detection Logic:(Unauthenticated)
This QID matches vulnerable versions based on the exposed banner information.

Successful exploitation of the vulnerability enables untrusted users to modify OpenSSL's default configuration, insert CA certificates, modify (or even replace) existing engine modules, etc.

  • CVSS V3 rated as Critical - 9.8 severity.
  • CVSS V2 rated as High - 7.5 severity.
    • Solution
    The vendor has released a patch. Fixed in OpenSSL 1.1.1l For more information please visit advisory.
    Vendor References

    CVEs related to QID 38855

    CVE-2021-3711 |
    Software Advisories
    Advisory ID Software Component Link
    20210824 URL Logo www.openssl.org/news/secadv/20210824.txt
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].