5.9
CVE-2021-3449
- EPSS 62.91%
- Veröffentlicht 25.03.2021 15:15:13
- Zuletzt bearbeitet 21.11.2024 06:21:33
- Erkennungen
LoginNULL pointer deref in signature_algorithms processing
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Debian ≫ Debian Linux Version 9.0
Debian ≫ Debian Linux Version 10.0
Netapp ≫ Active Iq Unified Manager Version - SwPlatform vmware_vsphere
Netapp ≫ Cloud Volumes Ontap Mediator Version -
Netapp ≫ E-series Performance Analyzer Version -
Netapp ≫ Oncommand Insight Version -
Netapp ≫ Oncommand Workflow Automation Version -
Netapp ≫ Ontap Select Deploy Administration Utility Version -
Netapp ≫ Santricity Smi-s Provider Version -
Netapp ≫ Snapcenter Version -
Netapp ≫ Storagegrid Version -
Tenable ≫ Log Correlation Engine Version < 6.0.9
Tenable ≫ Nessus Network Monitor Version 5.11.0
Tenable ≫ Nessus Network Monitor Version 5.11.1
Tenable ≫ Nessus Network Monitor Version 5.12.0
Tenable ≫ Nessus Network Monitor Version 5.12.1
Tenable ≫ Nessus Network Monitor Version 5.13.0
Tenable ≫ Tenable.Sc Version >= 5.13.0 <= 5.17.0
Fedoraproject ≫ Fedora Version 34
Mcafee ≫ Web Gateway Version 8.2.19
Mcafee ≫ Web Gateway Version 9.2.10
Mcafee ≫ Web Gateway Version 10.1.1
Mcafee ≫ Web Gateway Cloud Service Version 8.2.19
Mcafee ≫ Web Gateway Cloud Service Version 9.2.10
Mcafee ≫ Web Gateway Cloud Service Version 10.1.1
Checkpoint ≫ Quantum Security Management Firmware Version r80.40
Checkpoint ≫ Quantum Security Management Firmware Version r81
Checkpoint ≫ Multi-domain Management Firmware Version r80.40
Checkpoint ≫ Multi-domain Management Firmware Version r81
Checkpoint ≫ Quantum Security Gateway Firmware Version r80.40
Checkpoint ≫ Quantum Security Gateway Firmware Version r81
Oracle ≫ Communications Communications Policy Management Version 12.6.0.0.0
Oracle ≫ Enterprise Manager For Storage Management Version 13.4.0.0
Oracle ≫ Jd Edwards Enterpriseone Tools Version < 9.2.6.0
Oracle ≫ Jd Edwards World Security Version a9.4
Oracle ≫ Mysql Connectors Version <= 8.0.23
Oracle ≫ Mysql Server Version <= 5.7.33
Oracle ≫ Mysql Server Version >= 8.0.15 <= 8.0.23
Oracle ≫ Mysql Workbench Version <= 8.0.23
Oracle ≫ Peoplesoft Enterprise Peopletools Version 8.57
Oracle ≫ Peoplesoft Enterprise Peopletools Version 8.58
Oracle ≫ Peoplesoft Enterprise Peopletools Version 8.59
Oracle ≫ Primavera Unifier Version >= 17.7 <= 17.12
Oracle ≫ Primavera Unifier Version 19.12
Oracle ≫ Primavera Unifier Version 20.12
Oracle ≫ Primavera Unifier Version 21.12
Oracle ≫ Secure Backup Version < 18.1.0.1.0
Oracle ≫ Secure Global Desktop Version 5.6
Oracle ≫ Zfs Storage Appliance Kit Version 8.8
Sonicwall ≫ Sma100 Firmware Version >= 10.2.0.0 < 10.2.1.0-17sv
Sonicwall ≫ Capture Client Version 3.5
Siemens ≫ Ruggedcom Rcm1224 Firmware Version >= 6.2
Siemens ≫ Scalance M-800 Firmware Version >= 6.2
Siemens ≫ Scalance S602 Firmware Version >= 4.1
Siemens ≫ Scalance S612 Firmware Version >= 4.1
Siemens ≫ Scalance S615 Firmware Version >= 6.2
Siemens ≫ Scalance S623 Firmware Version >= 4.1
Siemens ≫ Scalance S627-2m Firmware Version >= 4.1
Siemens ≫ Scalance Sc-600 Firmware Version >= 2.0
Siemens ≫ Scalance W700 Firmware Version >= 6.5
Siemens ≫ Scalance W1700 Firmware Version >= 2.0
Siemens ≫ Scalance Xb-200 Firmware Version < 4.3
Siemens ≫ Scalance Xc-200 Firmware Version < 4.3
Siemens ≫ Scalance Xf-200ba Firmware Version < 4.3
Siemens ≫ Scalance Xm-400 Firmware Version < 6.4
Siemens ≫ Scalance Xp-200 Firmware Version < 4.3
Siemens ≫ Scalance Xr-300wg Firmware Version < 4.3
Siemens ≫ Scalance Xr524-8c Firmware Version < 6.4
Siemens ≫ Scalance Xr526-8c Firmware Version < 6.4
Siemens ≫ Scalance Xr528-6m Firmware Version < 6.4
Siemens ≫ Scalance Xr552-12 Firmware Version < 6.4
Siemens ≫ Simatic Cloud Connect 7 Firmware Version >= 1.1
Siemens ≫ Simatic Cloud Connect 7 Firmware Version -
Siemens ≫ Simatic Cp 1242-7 Gprs V2 Firmware Version >= 3.1
Siemens ≫ Simatic Cp 1242-7 Gprs V2 Firmware Version -
Siemens ≫ Simatic Net Cp 1243-1 Firmware Version >= 3.1
Siemens ≫ Simatic Net Cp1243-7 Lte Eu Firmware Version >= 3.1
Siemens ≫ Simatic Net Cp1243-7 Lte Us Firmware Version >= 3.1
Siemens ≫ Simatic Net Cp 1243-8 Irc Firmware Version >= 3.1
Siemens ≫ Simatic Net Cp 1542sp-1 Irc Firmware Version >= 2.1
Siemens ≫ Simatic Net Cp 1543-1 Firmware Version >= 2.2 < 3.0
Siemens ≫ Simatic Net Cp 1543sp-1 Firmware Version >= 2.1
Siemens ≫ Simatic Net Cp 1545-1 Firmware Version >= 1.0
Siemens ≫ Simatic Pdm Firmware Version >= 9.1.0.7
Siemens ≫ Simatic Process Historian Opc Ua Server Firmware Version >= 2019
Siemens ≫ Tim 1531 Irc Firmware Version >= 2.0 < 2.2
Siemens ≫ Simatic Logon Version >= 1.6.0.2
Siemens ≫ Simatic Logon Version 1.5 Update sp3_update_1
Siemens ≫ Simatic Wincc Telecontrol Version -
Siemens ≫ Sinema Server Version 14.0 Update -
Siemens ≫ Sinema Server Version 14.0 Update sp1
Siemens ≫ Sinema Server Version 14.0 Update sp2
Siemens ≫ Sinema Server Version 14.0 Update sp2_update1
Siemens ≫ Sinema Server Version 14.0 Update sp2_update2
Siemens ≫ Sinec Infrastructure Network Services Version < 1.0.1.1
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 62.91% | 0.991 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 5.9 | 2.2 | 3.6 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
|
| NIST | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:N/A:P
|
CWE-476 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujul2022.html
https://security.netapp.com/advisory/ntap-20240621-0006/
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
https://www.tenable.com/security/tns-2021-10
https://security.netapp.com/advisory/ntap-20210513-0002/
https://www.tenable.com/security/tns-2021-09
https://security.gentoo.org/glsa/202103-03
https://kc.mcafee.com/corporate/index?page=content&id=SB10356
http://www.openwall.com/lists/oss-security/2021/03/27/1
http://www.openwall.com/lists/oss-security/2021/03/27/2
http://www.openwall.com/lists/oss-security/2021/03/28/3
http://www.openwall.com/lists/oss-security/2021/03/28/4
https://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fb9fa6b51defd48157eeb207f52181f735d96148
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845
https://lists.debian.org/debian-lts-announce/2021/08/msg00029.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013
https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc
https://security.netapp.com/advisory/ntap-20210326-0006/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd
https://www.debian.org/security/2021/dsa-4875
https://www.openssl.org/news/secadv/20210325.txt
https://www.tenable.com/security/tns-2021-05
https://www.tenable.com/security/tns-2021-06