Back to the CVE list
CVE-2021-3449Suited to automated attack · CISA

NULL pointer deref in signature_algorithms processing

CVSS score

5.9

EPSS probability

%63.5

Risk score

3.7

Published

5 y ago

OverviewPublic Exploits (0)NewsroomVulnerability Timeline
Official patch verified

Etkilenen ürün ve sürüm için yayımlanan güvenlik güncellemesini uygulayın.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

DayBreach CVE AI Research

CVE-2021-3449 has vendor, distribution, patch and security-source records on file. We can compare them and prepare an explanation linked to the evidence.

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2021-3449 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

IDVENDORPRODUCTACTION
1opensslopenssl View
2opensslopenssl View
3debiandebian linux View
4debiandebian linux View
5freebsdfreebsd View
6netappactive iq unified manager View
7netappcloud volumes ontap mediator View
8netappe-series performance analyzer View
9netapponcommand insight View
10netapponcommand workflow automation View
11netappontap select deploy administration utility View
12netappsantricity smi-s provider View
13netappsnapcenter View
14netappstoragegrid View
15tenablelog correlation engine View
16tenablenessus View
17tenablenessus network monitor View
18tenablenessus network monitor View
19tenablenessus network monitor View
20tenablenessus network monitor View
21tenablenessus network monitor View
22tenabletenable.sc View
23fedoraprojectfedora View
24mcafeeweb gateway View
25mcafeeweb gateway View
26mcafeeweb gateway View
27mcafeeweb gateway cloud service View
28mcafeeweb gateway cloud service View
29mcafeeweb gateway cloud service View
30checkpointquantum security management firmware View
31checkpointquantum security management firmware View
32checkpointquantum security management View
33checkpointmulti-domain management firmware View
34checkpointmulti-domain management firmware View
35checkpointmulti-domain management View
36checkpointquantum security gateway firmware View
37checkpointquantum security gateway firmware View
38checkpointquantum security gateway View
39oraclecommunications communications policy management View
40oracleenterprise manager for storage management View
41oracleessbase View
42oraclegraalvm View
43oraclegraalvm View
44oraclegraalvm View
45oraclejd edwards enterpriseone tools View
46oraclejd edwards world security View
47oraclemysql connectors View
48oraclemysql server View
49oraclemysql server View
50oraclemysql workbench View
51oraclepeoplesoft enterprise peopletools View
52oraclepeoplesoft enterprise peopletools View
53oraclepeoplesoft enterprise peopletools View
54oracleprimavera unifier View
55oracleprimavera unifier View
56oracleprimavera unifier View
57oracleprimavera unifier View
58oraclesecure backup View
59oraclesecure global desktop View
60oraclezfs storage appliance kit View
61sonicwallsma100 firmware View
62sonicwallSMA100 View
63sonicwallcapture client View
64sonicwallSonicOS View
65siemensruggedcom rcm1224 firmware View
66siemensruggedcom rcm1224 View
67siemensscalance lpe9403 firmware View
68siemensscalance lpe9403 View
69siemensscalance m-800 firmware View
70siemensscalance m-800 View
71siemensscalance s602 firmware View
72siemensscalance s602 View
73siemensscalance s612 firmware View
74siemensscalance s612 View
75siemensscalance s615 firmware View
76siemensscalance s615 View
77siemensscalance s623 firmware View
78siemensscalance s623 View
79siemensscalance s627-2m firmware View
80siemensscalance s627-2m View
81siemensscalance sc-600 firmware View
82siemensscalance sc-600 View
83siemensscalance w700 firmware View
84siemensscalance w700 View
85siemensscalance w1700 firmware View
86siemensscalance w1700 View
87siemensscalance xb-200 firmware View
88siemensscalance xb-200 View
89siemensscalance xc-200 firmware View
90siemensscalance xc-200 View
91siemensscalance xf-200ba firmware View
92siemensscalance xf-200ba View
93siemensscalance xm-400 firmware View
94siemensscalance xm-400 View
95siemensscalance xp-200 firmware View
96siemensscalance xp-200 View
97siemensscalance xr-300wg firmware View
98siemensscalance xr-300wg View
99siemensscalance xr524-8c firmware View
100siemensscalance xr524-8c View
101siemensscalance xr526-8c firmware View
102siemensscalance xr526-8c View
103siemensscalance xr528-6m firmware View
104siemensSCALANCE XR528-6M View
105siemensscalance xr552-12 firmware View
106siemensscalance xr552-12 View
107siemenssimatic cloud connect 7 firmware View
108siemenssimatic cloud connect 7 firmware View
109siemenssimatic cloud connect 7 View
110siemenssimatic cp 1242-7 gprs v2 firmware View
111siemenssimatic cp 1242-7 gprs v2 firmware View
112siemenssimatic cp 1242-7 gprs v2 View
113siemenssimatic hmi basic panels 2nd generation firmware View
114siemenssimatic hmi basic panels 2nd generation View
115siemenssimatic hmi comfort outdoor panels firmware View
116siemenssimatic hmi comfort outdoor panels View
117siemenssimatic hmi ktp mobile panels firmware View
118siemenssimatic hmi ktp mobile panels View
119siemenssimatic mv500 firmware View
120siemenssimatic mv500 View
121siemenssimatic net cp 1243-1 firmware View
122siemenssimatic net cp 1243-1 View
123siemenssimatic net cp1243-7 lte eu firmware View
124siemenssimatic net cp1243-7 lte eu View
125siemenssimatic net cp1243-7 lte us firmware View
126siemenssimatic net cp1243-7 lte us View
127siemenssimatic net cp 1243-8 irc firmware View
128siemenssimatic net cp 1243-8 irc View
129siemenssimatic net cp 1542sp-1 irc firmware View
130siemenssimatic net cp 1542sp-1 irc View
131siemenssimatic net cp 1543-1 firmware View
132siemenssimatic net cp 1543-1 View
133siemenssimatic net cp 1543sp-1 firmware View
134siemenssimatic net cp 1543sp-1 View
135siemenssimatic net cp 1545-1 firmware View
136siemenssimatic net cp 1545-1 View
137siemenssimatic pcs 7 telecontrol firmware View
138siemensSIMATIC PCS 7 TeleControl View
139siemenssimatic pcs neo firmware View
140siemenssimatic pcs neo View
141siemenssimatic pdm firmware View
142siemenssimatic pdm View
143siemenssimatic process historian opc ua server firmware View
144siemenssimatic process historian opc ua server View
145siemenssimatic rf166c firmware View
146siemenssimatic rf166c View
147siemenssimatic rf185c firmware View
148siemenssimatic rf185c View
149siemenssimatic rf186c firmware View
150siemenssimatic rf186c View
151siemenssimatic rf186ci firmware View
152siemenssimatic rf186ci View
153siemenssimatic rf188c firmware View
154siemenssimatic rf188c View
155siemenssimatic rf188ci firmware View
156siemenssimatic rf188ci View
157siemenssimatic rf360r firmware View
158siemenssimatic rf360r View
159siemenssimatic s7-1200 cpu 1211c firmware View
160siemenssimatic s7-1200 cpu 1211c View
161siemenssimatic s7-1200 cpu 1212c firmware View
162siemenssimatic s7-1200 cpu 1212c View
163siemenssimatic s7-1200 cpu 1212fc firmware View
164siemenssimatic s7-1200 cpu 1212fc View
165siemenssimatic s7-1200 cpu 1214 fc firmware View
166siemenssimatic s7-1200 cpu 1214 fc View
167siemenssimatic s7-1200 cpu 1214c firmware View
168siemenssimatic s7-1200 cpu 1214c View
169siemenssimatic s7-1200 cpu 1215 fc firmware View
170siemenssimatic s7-1200 cpu 1215 fc View
171siemenssimatic s7-1200 cpu 1215c firmware View
172siemenssimatic s7-1200 cpu 1215c View
173siemenssimatic s7-1200 cpu 1217c firmware View
174siemenssimatic s7-1200 cpu 1217c View
175siemenssimatic s7-1500 cpu 1518-4 pn/dp mfp firmware View
176siemenssimatic s7-1500 cpu 1518-4 pn/dp mfp View
177siemenssinamics connect 300 firmware View
178siemenssinamics connect 300 View
179siemenstim 1531 irc firmware View
180siemenstim 1531 irc View
181siemenssimatic logon View
182siemenssimatic logon View
183siemensSIMATIC WinCC Runtime Advanced View
184siemensSIMATIC WinCC TeleControl View
185siemenssinec nms View
186siemenssinec pni View
187siemenssinema server View
188siemenssinumerik opc ua server View
189siemensTIA Administrator View
190siemenssinec infrastructure network services View
191nodejsnode.js View
192nodejsnode.js View
193nodejsnode.js View
194nodejsnode.js View
195nodejsnode.js View
196nodejsnode.js View
197nodejsnode.js View
Total affected vendors: 12|Products: 197

RED HAT CSAF/VEX: Product Impact Check

Red Hat has not yet published a CSAF/VEX impact record for this CVE. This does not mean “not affected”.

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCOREVERSIONSEVERITYVECTORSOURCE
5.9CVSS V31MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HNVD
4.3CVSS V2—AV:N/AC:M/Au:N/C:N/I:N/A:PNVD

Patch and Remediation Guide

Solution & Remediation Advisory

Patch verified

4 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

nvd

NVD tarafından Patch olarak etiketlenmiş referans

Open source
nvd

NVD tarafından Patch olarak etiketlenmiş referans

Open source
nvd

NVD tarafından Patch olarak etiketlenmiş referans

Open source
nvd

NVD tarafından Patch olarak etiketlenmiş referans

Open source
Confirm the affected product and version against the source evidence above.
Restrict access to internet-facing services and apply network segmentation.
Apply the official update named in the evidence only to the matching product and version.
Monitor server logs and network endpoints for signs of anomalous execution.

Public exploit and active exploitation status

Verified exploit intelligence

No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.

Weakness Classification and Attack Patterns (CWE & CAPEC)

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2021-3449 is associated with the following CWEs:

CWE-476: NULL Pointer Dereference

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2021-3449 weaknesses.

CAPEC-66: SQL InjectionCAPEC-126: Path TraversalCAPEC-28: OS Command Injection

Attack Vector and Accessibility

ExposureAğ üzerinden
PermissionsGerekmiyor
UserGerekmiyor

Official Sources and Advisories

https://www.openssl.org/news/secadv/20210325.txtvendor-advisoryhttps://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fb9fa6b51defd48157eeb207f52181f735d96148vendor-advisory20210325 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2021vendor-advisoryDSA-4875vendor-advisory[oss-security] 20210327 OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processingvendor-advisory[oss-security] 20210327 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processingvendor-advisory[oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processingvendor-advisory[oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processingvendor-advisoryGLSA-202103-03vendor-advisoryFEDORA-2021-cbf14ab8f9vendor-advisory

CVSS Vector Radar Chart

5.9 / 10
Attack VectorNetworkComplexityHighPrivilegesNoneUser Interact.NoneConfidentialityHighIntegrityNoneAvailabilityHigh

Vulnerability Scoring Details

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack VectorNetwork
Attack ComplexityHigh
Privileges RequiredNone required
User InteractionNone required
Confidentiality (Gizlilik)High
Integrity (Bütünlük)None
Availability (Erişilebilirlik)High

Yama doğrulandı

4 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

Follow the vendor

O
openssl logo
openssl
D
debian logo
debian
F
freebsd logo
freebsd
N
netapp logo
netapp
T
tenable logo
tenable
F
fedoraproject logo
fedoraproject

Weakness Type (CWE & CAPEC)

CWE-476

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.enginteksut.com.tr/api/v1/intel/cves/CVE-2021-3449"