fkie_cve-2021-3711
Vulnerability from fkie_nvd
Published
2021-08-24 15:15
Modified
2024-11-21 06:22
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).
References
openssl-security@openssl.orghttp://www.openwall.com/lists/oss-security/2021/08/26/2Mailing List, Third Party Advisory
openssl-security@openssl.orghttps://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfThird Party Advisory
openssl-security@openssl.orghttps://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=59f5e75f3bced8fc0e130d72a3f582cf7b480b46
openssl-security@openssl.orghttps://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e%40%3Cdev.tomcat.apache.org%3E
openssl-security@openssl.orghttps://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1%40%3Cdev.tomcat.apache.org%3E
openssl-security@openssl.orghttps://security.gentoo.org/glsa/202209-02Third Party Advisory
openssl-security@openssl.orghttps://security.gentoo.org/glsa/202210-02Third Party Advisory
openssl-security@openssl.orghttps://security.netapp.com/advisory/ntap-20210827-0010/Third Party Advisory
openssl-security@openssl.orghttps://security.netapp.com/advisory/ntap-20211022-0003/Third Party Advisory
openssl-security@openssl.orghttps://security.netapp.com/advisory/ntap-20240621-0006/
openssl-security@openssl.orghttps://www.debian.org/security/2021/dsa-4963Third Party Advisory
openssl-security@openssl.orghttps://www.openssl.org/news/secadv/20210824.txtVendor Advisory
openssl-security@openssl.orghttps://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
openssl-security@openssl.orghttps://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
openssl-security@openssl.orghttps://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
openssl-security@openssl.orghttps://www.tenable.com/security/tns-2021-16Third Party Advisory
openssl-security@openssl.orghttps://www.tenable.com/security/tns-2022-02Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2021/08/26/2Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=59f5e75f3bced8fc0e130d72a3f582cf7b480b46
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e%40%3Cdev.tomcat.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1%40%3Cdev.tomcat.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202209-02Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202210-02Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20210827-0010/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20211022-0003/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20240621-0006/
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2021/dsa-4963Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.openssl.org/news/secadv/20210824.txtVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.tenable.com/security/tns-2021-16Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.tenable.com/security/tns-2022-02Third Party Advisory
Impacted products
Vendor Product Version
openssl openssl *
debian debian_linux 10.0
debian debian_linux 11.0
netapp active_iq_unified_manager -
netapp active_iq_unified_manager -
netapp clustered_data_ontap -
netapp clustered_data_ontap_antivirus_connector -
netapp e-series_santricity_os_controller *
netapp hci_management_node -
netapp manageability_software_development_kit -
netapp oncommand_insight -
netapp oncommand_workflow_automation -
netapp santricity_smi-s_provider -
netapp snapcenter -
netapp solidfire -
netapp storage_encryption -
oracle communications_cloud_native_core_security_edge_protection_proxy 1.7.0
oracle communications_cloud_native_core_unified_data_repository 1.15.0
oracle communications_session_border_controller 8.4
oracle communications_session_border_controller 9.0
oracle communications_unified_session_manager 8.2.5
oracle communications_unified_session_manager 8.4.5
oracle enterprise_communications_broker 3.2.0
oracle enterprise_communications_broker 3.3.0
oracle enterprise_session_border_controller 8.4
oracle enterprise_session_border_controller 9.0
oracle essbase *
oracle essbase *
oracle health_sciences_inform_publisher 6.2.1.1
oracle health_sciences_inform_publisher 6.3.1.1
oracle jd_edwards_enterpriseone_tools *
oracle jd_edwards_world_security a9.4
oracle mysql_connectors *
oracle mysql_enterprise_monitor *
oracle mysql_server *
oracle mysql_server *
oracle peoplesoft_enterprise_peopletools 8.57
oracle peoplesoft_enterprise_peopletools 8.58
oracle peoplesoft_enterprise_peopletools 8.59
oracle zfs_storage_appliance_kit 8.8
tenable nessus_network_monitor *
tenable tenable.sc *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "A9592A08-7FF0-490F-B684-6EA8E49F36C7",
                     versionEndExcluding: "1.1.1l",
                     versionStartIncluding: "1.1.1",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "FA6FEEC2-9F11-4643-8827-749718254FED",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
                     matchCriteriaId: "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*",
                     matchCriteriaId: "B55E8D50-99B4-47EC-86F9-699B67D473CE",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "1FE996B1-6951-4F85-AA58-B99A379D2163",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "62347994-1353-497C-9C4A-D5D8D95F67E8",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "433D435D-13D0-4EAA-ACD9-DD88DA712D00",
                     versionEndIncluding: "11.50.2",
                     versionStartIncluding: "11.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "A3C19813-E823-456A-B1CE-EC0684CE1953",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "D39DCAE7-494F-40B2-867F-6C6A077939DD",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "5735E553-9731-4AAC-BCFF-989377F817B3",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "361B791A-D336-4431-8F68-8135BEFFAEA2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "BDFB1169-41A0-4A86-8E4F-FDA9730B1E94",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "A6E9EF0C-AFA8-4F7B-9FDC-1E0F7C26E737",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:storage_encryption:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "2D82795C-F1ED-4D2C-B578-75B9EECBB99C",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "BD4349FE-EEF8-489A-8ABF-5FCD55EC6DE0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C6EAA723-2A23-4151-930B-86ACF9CC1C0C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:communications_session_border_controller:8.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "9C416FD3-2E2F-4BBC-BD5F-F896825883F4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:communications_session_border_controller:9.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "D886339E-EDB2-4879-BD54-1800E4CA9CAE",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:communications_unified_session_manager:8.2.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "FB468FEE-A0F4-49A0-BBEE-10D0733C87D4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:communications_unified_session_manager:8.4.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "CC5C177E-0C77-48C9-847A-A9E5AA7DBC1F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "348EEE70-E114-4720-AAAF-E77DE5C9A2D1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:enterprise_communications_broker:3.3.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "3DCDD73B-57B1-4580-B922-5662E3AC13B6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:enterprise_session_border_controller:8.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "7015A8CB-8FA6-423E-8307-BD903244F517",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:enterprise_session_border_controller:9.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "F9A4E206-56C7-4578-AC9C-088B0C8D9CFE",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:essbase:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "C78A7E07-AB08-46C5-942D-B40BBE0C0D06",
                     versionEndExcluding: "11.1.2.4.47",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:essbase:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "F2A9C248-94B0-4F7B-AD9C-4BE55AA1E3F2",
                     versionEndExcluding: "21.3",
                     versionStartIncluding: "21.1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:health_sciences_inform_publisher:6.2.1.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "2F12453B-0E7B-46B9-ADEC-0AC5EDC41058",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:health_sciences_inform_publisher:6.3.1.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "5D105A5B-0AA8-4782-B804-CB1384F85884",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "BE34D4F7-5C18-4578-8D0A-722FDF931333",
                     versionEndExcluding: "9.2.6.3",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "0B1CAD50-749F-4ADB-A046-BF3585677A58",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "AE23C7E1-F849-411D-850F-A504D4BA3414",
                     versionEndIncluding: "8.0.27",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "88627B99-16DC-4878-A63A-A40F6FC1F477",
                     versionEndIncluding: "8.0.25",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "E667933A-37EA-4BC2-9180-C3B4B7038866",
                     versionEndIncluding: "5.7.35",
                     versionStartIncluding: "5.7.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "709E83B4-8C66-4255-870B-2F72B37BA8C6",
                     versionEndIncluding: "8.0.26",
                     versionStartIncluding: "8.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*",
                     matchCriteriaId: "7E1E416B-920B-49A0-9523-382898C2979D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*",
                     matchCriteriaId: "D9DB4A14-2EF5-4B54-95D2-75E6CF9AA0A9",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*",
                     matchCriteriaId: "C8AF00C6-B97F-414D-A8DF-057E6BFD8597",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*",
                     matchCriteriaId: "D3E503FB-6279-4D4A-91D8-E237ECF9D2B0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:tenable:nessus_network_monitor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "5FD1ED11-84AA-47E6-AD00-E08D035AF53B",
                     versionEndIncluding: "5.13.1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "8D977244-DC29-4301-8D89-0BD01BC328B8",
                     versionEndIncluding: "5.19.1",
                     versionStartIncluding: "5.16.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the \"out\" parameter can be NULL and, on exit, the \"outlen\" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the \"out\" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).",
      },
      {
         lang: "es",
         value: "Para descifrar los datos cifrados de SM2 se espera que una aplicación llame a la función de la API EVP_PKEY_decrypt(). Normalmente, una aplicación llamará a esta función dos veces. La primera vez, al entrar, el parámetro \"out\" puede ser NULL y, al salir, el parámetro \"outlen\" se rellena con el tamaño del búfer necesario para contener el texto plano descifrado. La aplicación puede entonces asignar un búfer de tamaño suficiente y llamar de nuevo a EVP_PKEY_decrypt(), pero esta vez pasando un valor no NULL para el parámetro \"out\". Un bug en la implementación del código de descifrado SM2 significa que el cálculo del tamaño del búfer necesario para mantener el texto plano devuelto por la primera llamada a EVP_PKEY_decrypt() puede ser menor que el tamaño real requerido por la segunda llamada. Esto puede conllevar a un desbordamiento del búfer cuando la aplicación llama a EVP_PKEY_decrypt() por segunda vez con un búfer demasiado pequeño. Un atacante malicioso que sea capaz de presentar el contenido de SM2 para su descifrado a una aplicación podría causar que los datos elegidos por el atacante desborden el búfer hasta un máximo de 62 bytes alterando el contenido de otros datos mantenidos después del búfer, posiblemente cambiando el comportamiento de la aplicación o causando el bloqueo de la misma. La ubicación del búfer depende de la aplicación, pero normalmente se asigna a la pila. Corregido en OpenSSL versión 1.1.1l (Afectada 1.1.1-1.1.1k).",
      },
   ],
   id: "CVE-2021-3711",
   lastModified: "2024-11-21T06:22:12.960",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 7.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 9.8,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2021-08-24T15:15:09.133",
   references: [
      {
         source: "openssl-security@openssl.org",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2021/08/26/2",
      },
      {
         source: "openssl-security@openssl.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=59f5e75f3bced8fc0e130d72a3f582cf7b480b46",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e%40%3Cdev.tomcat.apache.org%3E",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1%40%3Cdev.tomcat.apache.org%3E",
      },
      {
         source: "openssl-security@openssl.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.gentoo.org/glsa/202209-02",
      },
      {
         source: "openssl-security@openssl.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.gentoo.org/glsa/202210-02",
      },
      {
         source: "openssl-security@openssl.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20210827-0010/",
      },
      {
         source: "openssl-security@openssl.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20211022-0003/",
      },
      {
         source: "openssl-security@openssl.org",
         url: "https://security.netapp.com/advisory/ntap-20240621-0006/",
      },
      {
         source: "openssl-security@openssl.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.debian.org/security/2021/dsa-4963",
      },
      {
         source: "openssl-security@openssl.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.openssl.org/news/secadv/20210824.txt",
      },
      {
         source: "openssl-security@openssl.org",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
      },
      {
         source: "openssl-security@openssl.org",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://www.oracle.com/security-alerts/cpujan2022.html",
      },
      {
         source: "openssl-security@openssl.org",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
      },
      {
         source: "openssl-security@openssl.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.tenable.com/security/tns-2021-16",
      },
      {
         source: "openssl-security@openssl.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.tenable.com/security/tns-2022-02",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2021/08/26/2",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=59f5e75f3bced8fc0e130d72a3f582cf7b480b46",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e%40%3Cdev.tomcat.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1%40%3Cdev.tomcat.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.gentoo.org/glsa/202209-02",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.gentoo.org/glsa/202210-02",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20210827-0010/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20211022-0003/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://security.netapp.com/advisory/ntap-20240621-0006/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.debian.org/security/2021/dsa-4963",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.openssl.org/news/secadv/20210824.txt",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://www.oracle.com/security-alerts/cpujan2022.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.tenable.com/security/tns-2021-16",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.tenable.com/security/tns-2022-02",
      },
   ],
   sourceIdentifier: "openssl-security@openssl.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-120",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.