p PatchFirst

CVE-2021-3449

CVE-2021-3449 · NULL pointer deref in signature_algorithms processing

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).

CVSS 5.9 · Medium · EPSS 63.5% · Fix available

Published
Updated

Stack: system · network

Affected products and versions

  • openssl

    Versions
    • Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j): Affected

    No fix published

  • openssl Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.1.1k-1

    Update to 1.1.1k-1

  • openssl Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.1.1k-1

    Update to 1.1.1k-1

  • openssl Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.1.1k-1

    Update to 1.1.1k-1

  • openssl Ubuntu:18.04:LTS

    Versions
    • 1.0.2g-1ubuntu13
    • 1.0.2g-1ubuntu14
    • 1.0.2n-1ubuntu1
    • 1.1.0g-2ubuntu1
    • 1.1.0g-2ubuntu2
    • 1.1.0g-2ubuntu3
    • 1.1.0g-2ubuntu4
    • 1.1.0g-2ubuntu4.1
    • 1.1.0g-2ubuntu4.3
    • 1.1.1-1ubuntu2.1~18.04.1
    • 1.1.1-1ubuntu2.1~18.04.2
    • 1.1.1-1ubuntu2.1~18.04.3
    • 1.1.1-1ubuntu2.1~18.04.4
    • 1.1.1-1ubuntu2.1~18.04.5
    • 1.1.1-1ubuntu2.1~18.04.6
    • 1.1.1-1ubuntu2.1~18.04.7
    • 1.1.1-1ubuntu2.1~18.04.8
    Affected ranges
    • ECOSYSTEM: < 1.1.1-1ubuntu2.1~18.04.9

    Update to 1.1.1-1ubuntu2.1~18.04.9

  • postgresql-10 Ubuntu:18.04:LTS

    Versions
    • 10.1-1
    • 10.1-2
    • 10.2-1
    • 10.3-1
    • 10.4-0ubuntu0.18.04
    • 10.5-0ubuntu0.18.04
    • 10.6-0ubuntu0.18.04.1
    • 10.7-0ubuntu0.18.04.1
    • 10.8-0ubuntu0.18.04.1
    • 10.9-0ubuntu0.18.04.1
    • 10.10-0ubuntu0.18.04.1
    • 10.12-0ubuntu0.18.04.1
    • 10.14-0ubuntu0.18.04.1
    • 10.15-0ubuntu0.18.04.1
    • 10.16-0ubuntu0.18.04.1
    • 10.17-0ubuntu0.18.04.1
    Affected ranges
    • ECOSYSTEM: < 10.18-0ubuntu0.18.04.1

    Update to 10.18-0ubuntu0.18.04.1

  • openssl Ubuntu:Pro:FIPS-updates:18.04:LTS

    Versions
    • 1.1.1-1ubuntu2.fips.2.1~18.04.5.1
    • 1.1.1-1ubuntu2.fips.2.1~18.04.6.1
    • 1.1.1-1ubuntu2.fips.2.1~18.04.7.1
    Affected ranges
    • ECOSYSTEM: < 1.1.1-1ubuntu2.fips.2.1~18.04.9.1

    Update to 1.1.1-1ubuntu2.fips.2.1~18.04.9.1

  • openssl Ubuntu:Pro:FIPS:18.04:LTS

    Versions
    • 1.1.1-1ubuntu2.fips.2.1~18.04.3.1
    • 1.1.1-1ubuntu2.fips.2.1~18.04.15.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssl Ubuntu:20.04:LTS

    Versions
    • 1.1.1c-1ubuntu4
    • 1.1.1d-2ubuntu3
    • 1.1.1d-2ubuntu6
    • 1.1.1f-1ubuntu1
    • 1.1.1f-1ubuntu2
    • 1.1.1f-1ubuntu2.1
    • 1.1.1f-1ubuntu2.2
    Affected ranges
    • ECOSYSTEM: < 1.1.1f-1ubuntu2.3

    Update to 1.1.1f-1ubuntu2.3

  • postgresql-12 Ubuntu:20.04:LTS

    Versions
    • 12.0-1
    • 12.1-1
    • 12.1-2build1
    • 12.2-1
    • 12.2-1ubuntu2
    • 12.2-4
    • 12.4-0ubuntu0.20.04.1
    • 12.5-0ubuntu0.20.04.1
    • 12.6-0ubuntu0.20.04.1
    • 12.7-0ubuntu0.20.04.1
    Affected ranges
    • ECOSYSTEM: < 12.8-0ubuntu0.20.04.1

    Update to 12.8-0ubuntu0.20.04.1

  • openssl Ubuntu:Pro:FIPS-updates:20.04:LTS

    Affected ranges
    • ECOSYSTEM: < 1.1.1f-1ubuntu2.fips.7

    Update to 1.1.1f-1ubuntu2.fips.7

  • openssl Ubuntu:Pro:FIPS:20.04:LTS

    Affected ranges
    • ECOSYSTEM: < 1.1.1f-1ubuntu2.fips.2.8

    Update to 1.1.1f-1ubuntu2.fips.2.8

Original sources

Check your server →