The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the "-crl_download" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w).
El tipo GeneralName X.509 es un tipo genérico para representar diferentes tipos de nombres. Uno de esos tipos de nombres se conoce como EDIPartyName. OpenSSL proporciona una función GENERAL_NAME_cmp que compara diferentes instancias de GENERAL_NAME para ver si son iguales o no. Esta función se comporta incorrectamente cuando ambos GENERAL_NAME contienen un EDIPARTYNAME. Es posible que se produzca una desreferencia del puntero NULL y un bloqueo que conduzca a un posible ataque de denegación de servicio. El propio OpenSSL usa la función GENERAL_NAME_cmp para dos propósitos: 1) Comparación de nombres de puntos de distribución de CRL entre una CRL disponible y un punto de distribución de CRL insertado en un certificado X509 2) Al comparar que un firmante de token de respuesta de marca de tiempo coincide con el nombre de autoridad de marca de tiempo (expuesto por medio de las funciones API TS_RESP_verify_response y TS_RESP_verify_token) Si un atacante puede controlar ambos elementos que se están comparando, entonces ese atacante podría desencadenar un bloqueo. Por ejemplo, si el atacante puede engañar a un cliente o servidor para que compruebe un certificado malicioso con una CRL maliciosa, esto puede ocurrir. Tome en cuenta que algunas aplicaciones descargan automáticamente las CRL basadas en una URL insertada en un certificado. Esta comprobación ocurre antes de que se verifiquen las firmas en el certificado y la CRL. Las herramientas s_server, s_client y verify de OpenSSL tienen soporte para la opción "-crl_download" que implementa la descarga automática de CRL y se ha demostrado que este ataque funciona contra esas herramientas. Tome en cuenta que un error no relacionado significa que las versiones afectadas de OpenSSL no pueden analizar ni construir codificaciones correctas de EDIPARTYNAME. Sin embargo, es posible construir un EDIPARTYNAME malformado que el analizador de OpenSSL aceptará y, por lo tanto, desencadenará este ataque. Todas las versiones de OpenSSL 1.1.1 y 1.0.2 están afectadas por este problema. Otras versiones de OpenSSL no son compatibles y no se han comprobado. Corregido en OpenSSL versiones 1.1.1i (Afectado versiones 1.1.1-1.1.1h). Corregido en OpenSSL versiones 1.0.2x (Afectado versiones 1.0.2-1.0.2w). Sin embargo, es posible construir un EDIPARTYNAME malformado que el analizador de OpenSSL aceptará y, por lo tanto, desencadenará este ataque. Todas las versiones de OpenSSL 1.1.1 y 1.0.2 están afectadas por este problema. Otras versiones de OpenSSL no son compatibles y no se han comprobado. Corregido en OpenSSL versión 1.1.1i (Afectada versión 1.1.1-1.1.1h). Corregido en OpenSSL versión 1.0.2x (Afectada versión 1.0.2-1.0.2w). Sin embargo, es posible construir un EDIPARTYNAME malformado que el analizador de OpenSSL aceptará y, por lo tanto, desencadenará este ataque. Todas las versiones de OpenSSL 1.1.1 y 1.0.2 están afectadas por este problema. Otras versiones de OpenSSL no son compatibles y no se han comprobado. Corregido en OpenSSL versión 1.1.1i (Afectada versión 1.1.1-1.1.1h). Corregido en OpenSSL versión 1.0.2x (Afectada versión 1.0.2-1.0.2w)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | HIGH |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
AV:N/AC:M/Au:N/C:N/I:N/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | NONE |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-476
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary |
en
CWE-476
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| openssl | openssl | * | <built-in method update of dict object at 0x72a9b0c45fc0> | Application |
| openssl | openssl | * | <built-in method update of dict object at 0x72a99a7f0380> | Application |
| debian | debian_linux | 9.0 | <built-in method update of dict object at 0x72a9b0c47a00> | Operating System |
| debian | debian_linux | 10.0 | <built-in method update of dict object at 0x72a9b0c46340> | Operating System |
| fedoraproject | fedora | 32 | <built-in method update of dict object at 0x72a9b0c46a80> | Operating System |
| fedoraproject | fedora | 33 | <built-in method update of dict object at 0x72a9b0c47dc0> | Operating System |
| oracle | api_gateway | 11.1.2.4.0 | <built-in method update of dict object at 0x72a9a3091740> | Application |
| oracle | business_intelligence | 5.5.0.0.0 | <built-in method update of dict object at 0x72a99a7f2240> | Application |
| oracle | business_intelligence | 5.9.0.0.0 | <built-in method update of dict object at 0x72a9a3092200> | Application |
| oracle | business_intelligence | 12.2.1.3.0 | <built-in method update of dict object at 0x72a9b0c44c00> | Application |
| oracle | business_intelligence | 12.2.1.4.0 | <built-in method update of dict object at 0x72a9a30924c0> | Application |
| oracle | communications_cloud_native_core_network_function_cloud_native_environment | 1.10.0 | <built-in method update of dict object at 0x72a99a7f0640> | Application |
| oracle | communications_diameter_intelligence_hub | * | <built-in method update of dict object at 0x72a9b0c46200> | Application |
| oracle | communications_diameter_intelligence_hub | * | <built-in method update of dict object at 0x72a9a3093380> | Application |
| oracle | communications_session_border_controller | cz8.2 | <built-in method update of dict object at 0x72a9a3091bc0> | Application |
| oracle | communications_session_border_controller | cz8.3 | <built-in method update of dict object at 0x72a99a7f0cc0> | Application |
| oracle | communications_session_border_controller | cz8.4 | <built-in method update of dict object at 0x72a99a7f0a40> | Application |
| oracle | communications_session_router | cz8.2 | <built-in method update of dict object at 0x72a9a3091d80> | Application |
| oracle | communications_session_router | cz8.3 | <built-in method update of dict object at 0x72a99a7f1180> | Application |
| oracle | communications_session_router | cz8.4 | <built-in method update of dict object at 0x72a9cc7502c0> | Application |
| oracle | communications_subscriber-aware_load_balancer | cz8.2 | <built-in method update of dict object at 0x72a9a30925c0> | Application |
| oracle | communications_subscriber-aware_load_balancer | cz8.3 | <built-in method update of dict object at 0x72a99a7f3000> | Application |
| oracle | communications_subscriber-aware_load_balancer | cz8.4 | <built-in method update of dict object at 0x72a99a7f0900> | Application |
| oracle | communications_unified_session_manager | scz8.2.5 | <built-in method update of dict object at 0x72a9a3091500> | Application |
| oracle | enterprise_communications_broker | pcz3.1 | <built-in method update of dict object at 0x72a9cc724200> | Application |
| oracle | enterprise_communications_broker | pcz3.2 | <built-in method update of dict object at 0x72a9a3093e40> | Application |
| oracle | enterprise_communications_broker | pcz3.3 | <built-in method update of dict object at 0x72a9a3092080> | Application |
| oracle | enterprise_manager_base_platform | 13.3.0.0 | <built-in method update of dict object at 0x72a9e6dcb200> | Application |
| oracle | enterprise_manager_base_platform | 13.4.0.0 | <built-in method update of dict object at 0x72a99a7f3240> | Application |
| oracle | enterprise_manager_for_storage_management | 13.4.0.0 | <built-in method update of dict object at 0x72a99a7f1e40> | Application |
| oracle | enterprise_manager_ops_center | 12.4.0.0 | <built-in method update of dict object at 0x72a99a7f26c0> | Application |
| oracle | enterprise_session_border_controller | cz8.2 | <built-in method update of dict object at 0x72a99a7f2a40> | Application |
| oracle | enterprise_session_border_controller | cz8.3 | <built-in method update of dict object at 0x72a99a643980> | Application |
| oracle | enterprise_session_border_controller | cz8.4 | <built-in method update of dict object at 0x72a99a642680> | Application |
| oracle | essbase | 21.2 | <built-in method update of dict object at 0x72a99a643d80> | Application |
| oracle | graalvm | 19.3.4 | <built-in method update of dict object at 0x72a99a643300> | Application |
| oracle | graalvm | 20.3.0 | <built-in method update of dict object at 0x72a99a643380> | Application |
| oracle | http_server | 12.2.1.4.0 | <built-in method update of dict object at 0x72a99a643540> | Application |
| oracle | jd_edwards_enterpriseone_tools | * | <built-in method update of dict object at 0x72a99a640740> | Application |
| oracle | jd_edwards_world_security | a9.4 | <built-in method update of dict object at 0x72a99a642e80> | Application |
| oracle | mysql | * | <built-in method update of dict object at 0x72a99a643440> | Application |
| oracle | mysql_server | * | <built-in method update of dict object at 0x72a99a641ac0> | Application |
| oracle | mysql_server | * | <built-in method update of dict object at 0x72a99a640640> | Application |
| oracle | peoplesoft_enterprise_peopletools | 8.56 | <built-in method update of dict object at 0x72a99a643c80> | Application |
| oracle | peoplesoft_enterprise_peopletools | 8.57 | <built-in method update of dict object at 0x72a99a6423c0> | Application |
| oracle | peoplesoft_enterprise_peopletools | 8.58 | <built-in method update of dict object at 0x72a99a640e80> | Application |
| netapp | active_iq_unified_manager | - | <built-in method update of dict object at 0x72a99a640a80> | Application |
| netapp | active_iq_unified_manager | - | <built-in method update of dict object at 0x72a99a640a00> | Application |
| netapp | clustered_data_ontap_antivirus_connector | - | <built-in method update of dict object at 0x72a99a642600> | Application |
| netapp | data_ontap | - | <built-in method update of dict object at 0x72a99a642fc0> | Application |
| netapp | e-series_santricity_os_controller | * | <built-in method update of dict object at 0x72a99a643640> | Application |
| netapp | hci_management_node | - | <built-in method update of dict object at 0x72a99a640dc0> | Application |
| netapp | manageability_software_development_kit | - | <built-in method update of dict object at 0x72a99a643a40> | Application |
| netapp | oncommand_insight | - | <built-in method update of dict object at 0x72a99a641980> | Application |
| netapp | oncommand_workflow_automation | - | <built-in method update of dict object at 0x72a99a641a40> | Application |
| netapp | plug-in_for_symantec_netbackup | - | <built-in method update of dict object at 0x72a9b0918940> | Application |
| netapp | santricity_smi-s_provider | - | <built-in method update of dict object at 0x72a9cc89ae80> | Application |
| netapp | snapcenter | - | <built-in method update of dict object at 0x72a9cc89a100> | Application |
| netapp | solidfire | - | <built-in method update of dict object at 0x72a9cc89a9c0> | Application |
| netapp | hci_compute_node | - | <built-in method update of dict object at 0x72a9b0919e80> | Hardware |
| netapp | hci_storage_node | - | <built-in method update of dict object at 0x72a9cc899c40> | Hardware |
| netapp | ef600a_firmware | - | <built-in method update of dict object at 0x72a9cc899d40> | Operating System |
| netapp | aff_a250_firmware | - | <built-in method update of dict object at 0x72a9cc899780> | Operating System |
| tenable | log_correlation_engine | * | <built-in method update of dict object at 0x72a9cc89ac80> | Application |
| tenable | nessus_network_monitor | * | <built-in method update of dict object at 0x72a9cc89bf40> | Application |
| siemens | sinec_infrastructure_network_services | * | <built-in method update of dict object at 0x72a9cc898680> | Application |
| nodejs | node.js | * | <built-in method update of dict object at 0x72a9cc89a380> | Application |
| nodejs | node.js | * | <built-in method update of dict object at 0x72a9cc89a900> | Application |
| nodejs | node.js | * | <built-in method update of dict object at 0x72a9cc89b4c0> | Application |
| nodejs | node.js | * | <built-in method update of dict object at 0x72a9cc89a7c0> | Application |
| nodejs | node.js | * | <built-in method update of dict object at 0x72a9cc899bc0> | Application |
| nodejs | node.js | * | <built-in method update of dict object at 0x72a9cc899980> | Application |
| nodejs | node.js | * | <built-in method update of dict object at 0x72a9cc899cc0> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:* |
| Yes | cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:* |
| Yes | cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:* |
| Yes | cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_session_border_controller:cz8.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_session_border_controller:cz8.3:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_session_border_controller:cz8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_session_router:cz8.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_session_router:cz8.3:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_session_router:cz8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.3:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_unified_session_manager:scz8.2.5:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.3:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.4.0.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.3:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:essbase:21.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:graalvm:19.3.4:*:*:*:enterprise:*:*:* |
| Yes | cpe:2.3:a:oracle:graalvm:20.3.0:*:*:*:enterprise:*:*:* |
| Yes | cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* |
| Yes | cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* |
| Yes | cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:data_ontap:-:*:*:*:*:7-mode:*:* |
| Yes | cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:ef600a_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:ef600a:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:aff_a250_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:aff_a250:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:tenable:nessus_network_monitor:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* |
| Yes | cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* |
| Yes | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* |
| Yes | cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* |
| Yes | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* |
| Yes | cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* |
| Yes | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* |