IM
IronMonkey Threat Research

CVE-2021-23841 MEDIUM

Published: 2021-02-16 | Last Modified: 2024-11-21 | Status: Modified

Description

The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Additional Descriptions (1)

La función de la API pública de OpenSSL X509_issuer_and_serial_hash() intenta crear un valor hash único basado en los datos del emisor y del número de serie contenidos en un certificado X509. Sin embargo, no gestiona correctamente los errores que puedan producirse al analizar el campo del emisor (lo que podría ocurrir si el campo del emisor se construye de forma maliciosa). Esto puede dar lugar a un desvío de puntero NULL y a un fallo que conduzca a un posible ataque de denegación de servicio. La función X509_issuer_and_serial_hash() nunca es llamada directamente por OpenSSL, por lo que las aplicaciones sólo son vulnerables si utilizan esta función directamente y lo hacen con certificados que pueden haber sido obtenidos de fuentes no fiables. Las versiones de OpenSSL 1.1.1i y posteriores están afectadas por este problema. Los usuarios de estas versiones deberían actualizar a OpenSSL 1.1.1j. Las versiones de OpenSSL 1.0.2x e inferiores se ven afectadas por este problema. Sin embargo, OpenSSL 1.0.2 está fuera de soporte y ya no recibe actualizaciones públicas. Los clientes con soporte Premium de OpenSSL 1.0.2 deben actualizar a la versión 1.0.2y. Los demás usuarios deben actualizar a la versión 1.1.1j. Corregido en OpenSSL 1.1.1j (Afectado 1.1.1-1.1.1i). Corregido en OpenSSL 1.0.2y (Afectado 1.0.2-1.0.2x)

CVSS Metrics

Base Score: 5.9 (MEDIUM)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack VectorNETWORK
Attack ComplexityHIGH
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 2.2

Impact Score: 3.6

Base Score: 4.3 (MEDIUM)

AV:N/AC:M/Au:N/C:N/I:N/A:P

Access VectorNETWORK
Access ComplexityMEDIUM
AuthenticationNONE
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 8.6

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-476

Affected Products

Vendor Product Version Update Type
openssl openssl * <built-in method update of dict object at 0x72a9b09239c0> Application
openssl openssl * <built-in method update of dict object at 0x72a9ccf03240> Application
debian debian_linux 10.0 <built-in method update of dict object at 0x72a9b0d8db80> Operating System
tenable nessus_network_monitor 5.11.0 <built-in method update of dict object at 0x72a961ec1480> Application
tenable nessus_network_monitor 5.11.1 <built-in method update of dict object at 0x72a9b0922cc0> Application
tenable nessus_network_monitor 5.12.0 <built-in method update of dict object at 0x72a9b0920d80> Application
tenable nessus_network_monitor 5.12.1 <built-in method update of dict object at 0x72a9a0123c80> Application
tenable nessus_network_monitor 5.13.0 <built-in method update of dict object at 0x72a9b0d8c140> Application
tenable tenable.sc * <built-in method update of dict object at 0x72a9a0123f80> Application
apple safari * <built-in method update of dict object at 0x72a9b0920a00> Application
apple ipados * <built-in method update of dict object at 0x72a9b0d8fb40> Operating System
apple iphone_os * <built-in method update of dict object at 0x72a9ccf01600> Operating System
apple macos * <built-in method update of dict object at 0x72a9b0d8e180> Operating System
netapp oncommand_insight - <built-in method update of dict object at 0x72a9b0d8c2c0> Application
netapp oncommand_workflow_automation - <built-in method update of dict object at 0x72a9b0d8d880> Application
netapp snapcenter - <built-in method update of dict object at 0x72a9b0d8d540> Application
oracle business_intelligence 5.5.0.0.0 <built-in method update of dict object at 0x72a9b0922a00> Application
oracle business_intelligence 5.9.0.0.0 <built-in method update of dict object at 0x72a9a0122d40> Application
oracle business_intelligence 12.2.1.3.0 <built-in method update of dict object at 0x72a9b0d8d680> Application
oracle business_intelligence 12.2.1.4.0 <built-in method update of dict object at 0x72a961ec0d00> Application
oracle communications_cloud_native_core_policy 1.15.0 <built-in method update of dict object at 0x72a9b0d8d740> Application
oracle enterprise_manager_for_storage_management 13.4.0.0 <built-in method update of dict object at 0x72a9ccf02ec0> Application
oracle enterprise_manager_ops_center 12.4.0.0 <built-in method update of dict object at 0x72a9b0d8ee00> Application
oracle essbase 21.2 <built-in method update of dict object at 0x72a9a0121880> Application
oracle graalvm 19.3.5 <built-in method update of dict object at 0x72a9b0d8ee80> Application
oracle graalvm 20.3.1.2 <built-in method update of dict object at 0x72a9b0d8d840> Application
oracle graalvm 21.0.0.2 <built-in method update of dict object at 0x72a9cd090640> Application
oracle jd_edwards_world_security a9.4 <built-in method update of dict object at 0x72a9b0d8ca80> Application
oracle mysql_enterprise_monitor * <built-in method update of dict object at 0x72a9b0d8ec40> Application
oracle mysql_server * <built-in method update of dict object at 0x72a9cd05d9c0> Application
oracle mysql_server * <built-in method update of dict object at 0x72a9cd05f240> Application
oracle peoplesoft_enterprise_peopletools 8.57 <built-in method update of dict object at 0x72a9cd05d540> Application
oracle peoplesoft_enterprise_peopletools 8.58 <built-in method update of dict object at 0x72a9cd05d880> Application
oracle peoplesoft_enterprise_peopletools 8.59 <built-in method update of dict object at 0x72a9cd05cb00> Application
oracle zfs_storage_appliance_kit 8.8 <built-in method update of dict object at 0x72a9cd05f300> Application
siemens sinec_ins * <built-in method update of dict object at 0x72a9b0c34e00> Application
siemens sinec_ins 1.0 <built-in method update of dict object at 0x72a9b0c368c0> Application
siemens sinec_ins 1.0 <built-in method update of dict object at 0x72a9b0c37280> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:tenable:nessus_network_monitor:5.11.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:tenable:nessus_network_monitor:5.11.1:*:*:*:*:*:*:*
Yes cpe:2.3:a:tenable:nessus_network_monitor:5.12.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:tenable:nessus_network_monitor:5.12.1:*:*:*:*:*:*:*
Yes cpe:2.3:a:tenable:nessus_network_monitor:5.13.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:*
Yes cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:*
Yes cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:*
Yes cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*
Yes cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.4.0.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:essbase:21.2:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:graalvm:19.3.5:*:*:*:enterprise:*:*:*
Yes cpe:2.3:a:oracle:graalvm:20.3.1.2:*:*:*:enterprise:*:*:*
Yes cpe:2.3:a:oracle:graalvm:21.0.0.2:*:*:*:enterprise:*:*:*
Yes cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:*
Yes cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*

References

Notification
Message here