5.9

CVE-2021-3449

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
OpenSSL ≫ OpenSSL Version >= 1.1.1 < 1.1.1k
Debian ≫ Debian Linux Version9.0
Debian ≫ Debian Linux Version10.0
Freebsd ≫ Freebsd Version12.2 Update-
Freebsd ≫ Freebsd Version12.2 Updatep1
Freebsd ≫ Freebsd Version12.2 Updatep2
Netapp ≫ Active Iq Unified Manager Version- SwPlatformvmware_vsphere
Netapp ≫ Oncommand Insight Version-
Netapp ≫ Snapcenter Version-
Netapp ≫ Storagegrid Version-
Tenable ≫ Log Correlation Engine Version < 6.0.9
Tenable ≫ Nessus Version <= 8.13.1
Tenable ≫ Nessus Network Monitor Version5.11.0
Tenable ≫ Nessus Network Monitor Version5.11.1
Tenable ≫ Nessus Network Monitor Version5.12.0
Tenable ≫ Nessus Network Monitor Version5.12.1
Tenable ≫ Nessus Network Monitor Version5.13.0
Tenable ≫ Tenable.Sc Version >= 5.13.0 <= 5.17.0
Fedoraproject ≫ Fedora Version34
Mcafee ≫ Web Gateway Version8.2.19
Mcafee ≫ Web Gateway Version9.2.10
Mcafee ≫ Web Gateway Version10.1.1
Mcafee ≫ Web Gateway Cloud Service Version8.2.19
Mcafee ≫ Web Gateway Cloud Service Version9.2.10
Mcafee ≫ Web Gateway Cloud Service Version10.1.1
Oracle ≫ Essbase Version21.2
Oracle ≫ Graalvm Version19.3.5 SwEditionenterprise
Oracle ≫ Graalvm Version20.3.1.2 SwEditionenterprise
Oracle ≫ Graalvm Version21.0.0.2 SwEditionenterprise
Oracle ≫ Jd Edwards Enterpriseone Tools Version < 9.2.6.0
Oracle ≫ Mysql Connectors Version <= 8.0.23
Oracle ≫ Mysql Server Version <= 5.7.33
Oracle ≫ Mysql Server Version >= 8.0.15 <= 8.0.23
Oracle ≫ Mysql Workbench Version <= 8.0.23
Oracle ≫ Primavera Unifier Version >= 17.7 <= 17.12
Oracle ≫ Primavera Unifier Version19.12
Oracle ≫ Primavera Unifier Version20.12
Oracle ≫ Primavera Unifier Version21.12
Oracle ≫ Secure Backup Version < 18.1.0.1.0
Oracle ≫ Secure Global Desktop Version5.6
Sonicwall ≫ Sma100 Firmware Version >= 10.2.0.0 < 10.2.1.0-17sv
   Sonicwall ≫ Sma100 Version-
Sonicwall ≫ Capture Client Version3.5
Sonicwall ≫ Sonicos Version7.0.1.0
Siemens ≫ Ruggedcom Rcm1224 Firmware Version >= 6.2
   Siemens ≫ Ruggedcom Rcm1224 Version-
Siemens ≫ Scalance M-800 Firmware Version >= 6.2
   Siemens ≫ Scalance M-800 Version-
Siemens ≫ Scalance S602 Firmware Version >= 4.1
   Siemens ≫ Scalance S602 Version-
Siemens ≫ Scalance S612 Firmware Version >= 4.1
   Siemens ≫ Scalance S612 Version-
Siemens ≫ Scalance S615 Firmware Version >= 6.2
   Siemens ≫ Scalance S615 Version-
Siemens ≫ Scalance S623 Firmware Version >= 4.1
   Siemens ≫ Scalance S623 Version-
Siemens ≫ Scalance S627-2m Firmware Version >= 4.1
   Siemens ≫ Scalance S627-2m Version-
Siemens ≫ Scalance Sc-600 Firmware Version >= 2.0
   Siemens ≫ Scalance Sc-600 Version-
Siemens ≫ Scalance W700 Firmware Version >= 6.5
   Siemens ≫ Scalance W700 Version-
Siemens ≫ Scalance W1700 Firmware Version >= 2.0
   Siemens ≫ Scalance W1700 Version-
Siemens ≫ Scalance Xb-200 Firmware Version < 4.3
   Siemens ≫ Scalance Xb-200 Version-
Siemens ≫ Scalance Xc-200 Firmware Version < 4.3
   Siemens ≫ Scalance Xc-200 Version-
Siemens ≫ Scalance Xf-200ba Firmware Version < 4.3
   Siemens ≫ Scalance Xf-200ba Version-
Siemens ≫ Scalance Xm-400 Firmware Version < 6.4
   Siemens ≫ Scalance Xm-400 Version-
Siemens ≫ Scalance Xp-200 Firmware Version < 4.3
   Siemens ≫ Scalance Xp-200 Version-
Siemens ≫ Scalance Xr-300wg Firmware Version < 4.3
   Siemens ≫ Scalance Xr-300wg Version-
Siemens ≫ Scalance Xr524-8c Firmware Version < 6.4
   Siemens ≫ Scalance Xr524-8c Version-
Siemens ≫ Scalance Xr526-8c Firmware Version < 6.4
   Siemens ≫ Scalance Xr526-8c Version-
Siemens ≫ Scalance Xr528-6m Firmware Version < 6.4
   Siemens ≫ Scalance Xr528-6m Version-
Siemens ≫ Scalance Xr552-12 Firmware Version < 6.4
   Siemens ≫ Scalance Xr552-12 Version-
Siemens ≫ Simatic Net Cp 1543-1 Firmware Version >= 2.2 < 3.0
   Siemens ≫ Simatic Net Cp 1543-1 Version-
Siemens ≫ Simatic Pdm Firmware Version >= 9.1.0.7
   Siemens ≫ Simatic Pdm Version-
Siemens ≫ Tim 1531 Irc Firmware Version >= 2.0 < 2.2
   Siemens ≫ Tim 1531 Irc Version-
Siemens ≫ Simatic Logon Version >= 1.6.0.2
Siemens ≫ Simatic Logon Version1.5 Updatesp3_update_1
Siemens ≫ Sinec Nms Version1.0 Update-
Siemens ≫ Sinec Nms Version1.0 Updatesp1
Siemens ≫ Sinec Pni Version-
Siemens ≫ Sinema Server Version14.0 Update-
Siemens ≫ Sinema Server Version14.0 Updatesp1
Siemens ≫ Sinema Server Version14.0 Updatesp2
Siemens ≫ Sinema Server Version14.0 Updatesp2_update1
Siemens ≫ Sinema Server Version14.0 Updatesp2_update2
Nodejs ≫ Node.Js SwEdition- Version >= 10.0.0 <= 10.12.0
Nodejs ≫ Node.Js SwEditionlts Version >= 10.13.0 <= 10.24.0
Nodejs ≫ Node.Js SwEdition- Version >= 12.0.0 <= 12.12.0
Nodejs ≫ Node.Js SwEditionlts Version >= 12.13.0 < 12.22.1
Nodejs ≫ Node.Js SwEdition- Version >= 14.0.0 <= 14.14.0
Nodejs ≫ Node.Js SwEditionlts Version >= 14.15.0 < 14.16.1
Nodejs ≫ Node.Js SwEdition- Version >= 15.0.0 < 15.14.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 13.18% 0.939
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.9 2.2 3.6
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:N/A:P
CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.