Published: 25/03/2021 Updated: 07/11/2023

CVSS v2 Base Score: 5.8 | Impact Score: 4.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 7.4 | Impact Score: 5.2 | Exploitability Score: 2.2

VMScore: 516

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N

On March 25, 2021, the OpenSSL Project released a security advisory, OpenSSL Security Advisory [25 March 2021], that disclosed two vulnerabilities. Exploitation of these vulnerabilities could allow an malicious user to use a valid non-certificate authority (CA) certificate to act as a CA and sign a certificate for an arbitrary organization, user or device, or to cause a denial of service (DoS) condition. This advisory is available at the following link:tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd

Vulnerable Product	Search on Vulmon	Subscribe to Product
openssl openssl
freebsd freebsd 12.2
netapp santricity_smi-s_provider_firmware -
netapp storagegrid_firmware -
windriver linux -
windriver linux 18.0
windriver linux 19.0
windriver linux 17.0
netapp oncommand workflow automation -
netapp storagegrid -
netapp ontap select deploy administration utility -
netapp cloud volumes ontap mediator -
fedoraproject fedora 34
tenable nessus agent
tenable nessus
tenable nessus network monitor 5.11.1
tenable nessus network monitor 5.12.0
tenable nessus network monitor 5.12.1
tenable nessus network monitor 5.13.0
tenable nessus network monitor 5.11.0
oracle jd edwards world security a9.4
oracle weblogic server 12.2.1.4.0
oracle weblogic server 14.1.1.0.0
oracle enterprise manager for storage management 13.4.0.0
oracle secure global desktop 5.6
oracle graalvm 20.3.1.2
oracle graalvm 21.0.0.2
oracle graalvm 19.3.5
oracle mysql server
oracle mysql workbench
oracle commerce guided search 11.3.2
oracle mysql connectors
oracle jd edwards enterpriseone tools
oracle mysql enterprise monitor
oracle secure backup
oracle peoplesoft enterprise peopletools
mcafee web gateway cloud service 10.1.1
mcafee web gateway cloud service 9.2.10
mcafee web gateway cloud service 8.2.19
mcafee web gateway 10.1.1
mcafee web gateway 9.2.10
mcafee web gateway 8.2.19
sonicwall sma100_firmware
sonicwall sonicos
sonicwall email security
sonicwall capture client
nodejs node.js

Synopsis Moderate: OpenShift Container Platform 4103 security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 4103 is now available withupdates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a security impact of ...

A flaw was found in openssl The flag that enables additional security checks of certificates present in a certificate chain was not enabled allowing a confirmation step to verify that certificates in the chain are valid CA certificates is bypassed The highest threat from this vulnerability is to data confidentiality and integrity ...

On March 25, 2021, the OpenSSL Project released a security advisory, OpenSSL Security Advisory [25 March 2021], that disclosed two vulnerabilities Exploitation of these vulnerabilities could allow an attacker to use a valid non-certificate authority (CA) certificate to act as a CA and sign a certificate for an arbitrary organization, user or devic ...

A null pointer dereference flaw was found in openssl A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service The highest threat from this vulnerability is to system availability (CVE-2020-1971) Calls to EVP_CipherUpdate, EVP_En ...

A flaw was found in openssl A server crash and denial of service attack could occur if a client sends a TLSv12 renegotiation ClientHello and omits the signature_algorithms extension but includes a signature_algorithms_cert extension The highest threat from this vulnerability is to system availability (CVE-2021-3449) A flaw was found in openssl ...

The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain It is not set by default Starting from OpenSSL version 111h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check An error in the impleme ...

Nessus leverages third-party software to help provide underlying functionality One of the third-party components (OpenSSL) was found to contain vulnerabilities, and updated versions have been made available by the providers Out of caution and in line with good practice, Tenable opted to upgrade the bundled OpenSSL components to address the poten ...

Nessus Network Monitor leverages third-party software to help provide underlying functionality One of the third-party components (OpenSSL) was found to contain vulnerabilities, and updated versions have been made available by the providers Out of caution and in line with good practice, Tenable opted to upgrade the bundled OpenSSL components to a ...

Multiple vulnerabilities have been found in Hitachi Ops Center Common Services CVE-2021-3449, CVE-2021-3450, CVE-2021-23840, CVE-2021-23841 Affected products and versions are listed below Please upgrade your version to the appropriate version ...

Multiple vulnerabilities have been found in Hitachi Ops Center Analyzer viewpoint CVE-2020-1971, CVE-2021-3393, CVE-2021-3449, CVE-2021-3450, CVE-2021-23840, CVE-2021-23841 Affected products and versions are listed below Please upgrade your version to the appropriate version ...

Critical Infrastructure Sectors: Energy

The Panthera(P.)uncia of Cybersecurity - Subdomain & Exploit Hunter powered by AI

The Panthera(P)uncia of Cybersecurity Subdomain & Exploit Hunter powered by AI Puncia utilizes two of our intelligent APIs - Subdomain Center & Exploit Observer, to gather the results Please note that although these results can sometimes be pretty inaccurate & unreliable, they can greatly differ from time to time due to their self-improvement cap

OpenSSL shuts down two high-severity bugs: Flaws enable cert shenanigans, denial-of-service attacks

The Register • Thomas Claburn in San Francisco • 25 Mar 2021

Debian, Ubuntu ahead of the curve in patching at least – don't be late yourself How do you fix a problem like open-source security? Google has an idea, though constraints may not go down well

Two high-severity vulnerabilities in the OpenSSL software library were disclosed on Thursday alongside the release of a patched version of the software, OpenSSL 1.1.1k. OpenSSL is widely used to implement the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols, which support encrypted network connections. Alternatives include BoringSSL and LibreSSL, among others. The first flaw, a certificate check bypass (CVE-2021-3450), arose as a result of code implemented in v1.1.1h to pe...

CVE-2021-3450

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

Github Repositories

Recent Articles

References

Vulmon Search

About

Products

Connect