Most recent entries from all

bdu:2021-01844

Withdrawn: BELL-CVE-2021-3449 — CVE-2021-3449 does not affect BellSoft software

Withdrawn by the publisher.

BIT-node-2021-3449 — NULL pointer deref in signature_algorithms processing

Affected: Bitnami: node

certfr-2021-avi-221 — De multiples vulnérabilités ont été découvertes dans OpenSSL. Elles permettent à un attaquant de provoquer un problème…

certfr-2021-avi-221

cisco-sa-openssl-2021-GHY28dJd — Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2021

On March 25, 2021, the OpenSSL Project released a security advisory, OpenSSL Security Advisory [25 March 2021], ["https://www.openssl.org/news/secadv/20210325.txt"] that disclosed two vulnerabilities. Exploitation of these vulnerabilities could allow an attacker to use a valid non-certificate authority (CA) certificate to act as a CA and sign a certificate for an arbitrary organization, user or device, or to cause a denial of service (DoS) condition.

Withdrawn: CLEANSTART-2026-GK72927 — Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation which can trigger a stack-based buffer overflo…

Withdrawn by the publisher.

Affected: CleanStart: openssl

Multiple security vulnerabilities affect the openssl package. Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation which can trigger a stack-based buffer overflow, invalid pointer or NULL pointer dereference during MAC verification. See references for individual vulnerability details.

cnvd-2021-39524

EUVD-2026-184444

fkie_cve-2021-3449

GHSA-83mx-573x-5rw9 — openssl-src NULL pointer Dereference in signature_algorithms processing

Affected: crates.io: openssl-src

gsd-2021-3449

ICSA-21-336-06 — Hitachi Energy APM Edge

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j). Hitachi Energy is aware of public reports of this vulnerability in the following open-source software components: OpenSSL, LibSSL, libxml2 and GRUB2 bootloader. The vulnerability also affects some APM Edge products. An attacker who successfully exploits this vulnerability could cause the product to become inaccessible. SEE NVD for full Description. In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not a…

OESA-2021-1147 — openssl security update

Affected: openEuler:20.03-LTS-SP1: openssl

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. Security Fix(es): An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).(CVE-2021-3449)

openSUSE-SU-2021:0476-1 — Security update for openssl-1_1

Security update for openssl-1_1

RHSA-2021:1063 — Red Hat Security Advisory: openssl security update

openssl: NULL pointer dereference in signature_algorithms processing

RUSTSEC-2021-0055 — NULL pointer deref in signature_algorithms processing

Affected: crates.io: openssl-src

A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue.

SUSE-SU-2021:0954-1 — Security update for openssl-1_1

Security update for openssl-1_1

UBUNTU-CVE-2021-3449

Affected: Ubuntu:18.04:LTS: openssl, Ubuntu:18.04:LTS: postgresql-10, Ubuntu:Pro:FIPS-updates:18.04:LTS: openssl, Ubuntu:Pro:FIPS:18.04:LTS: openssl, Ubuntu:20.04:LTS: openssl, Ubuntu:20.04:LTS: postgresql-12, Ubuntu:Pro:FIPS-updates:20.04:LTS: openssl, Ubuntu:Pro:FIPS:20.04:LTS: openssl

VDE-2021-025 — PHOENIX CONTACT: Security Advisory for PLCNext, ILC 2050 BI, FL MGUARD DM UNLIMITED, TC ROUTER und CLOUD CLIENT products

A Denial of Service and a CA Check Problem have been identified in multiple openSSL 1.1.1 versions, which are utilized in the Phoenix Contact products listed above.

WID-SEC-W-2022-0671 — OpenSSL: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in OpenSSL ausnutzen, um einen Denial of Service Angriff durchzuführen und um kryptografische Sicherheitsmechanismen zu umgehen.