Rapid7 Vulnerability & Exploit Database

CentOS Linux: CVE-2021-3449: Important: openssl security update (CESA-2021:1024)

Free InsightVM Trial No Credit Card Necessary
Watch Demo See how it all works
Back to Search

CentOS Linux: CVE-2021-3449: Important: openssl security update (CESA-2021:1024)

Severity
4
CVSS
(AV:N/AC:M/Au:N/C:N/I:N/A:P)
Published
03/25/2021
Created
04/01/2021
Added
03/31/2021
Modified
05/25/2023

Description

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).

Solution(s)

  • centos-upgrade-openssl
  • centos-upgrade-openssl-debuginfo
  • centos-upgrade-openssl-debugsource
  • centos-upgrade-openssl-devel
  • centos-upgrade-openssl-libs
  • centos-upgrade-openssl-libs-debuginfo
  • centos-upgrade-openssl-perl

References

  • DSA-4875
  • CVE-2021-3449

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;