CVE-2021-23839

CWE-327 — Broken Cryptographic AlgorithmCWE-3267 documents7 sources
Severity
3.7LOW
EPSS
0.3%
top 47.42%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Siemens Sinec INSOpenssl OpensslOracle Business Intelligence+5 more
Timeline
PublishedFeb 16
Latest updateMay 24

Description

OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS versions then a check is made for a version rollback attack when unpadding an RSA signature. Clients that support SSL or TLS versions greater than SSLv2 are supposed to use a special form of padding. A server that supports greater than SSLv2 is supposed to reject connection attempts from a client where this special form of padding is present, be…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 2.2 | Impact: 1.4

Affected Packages10 packages

▶Debianopenssl< 1.0.0d-1+3
▶NVDopenssl/openssl1.0.2s — 1.0.2x
▶CVEListV5openssl/opensslFixed in OpenSSL 1.0.2y (Affected 1.0.2s-1.0.2x)
▶NVDsiemens/sinec_ins< 1.0+1

Patches

Patch: cert-portal.siemens.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-rh82-fhxg-rxx8: OpenSSL 1↗2022-05-24
▶
CVEList
Incorrect SSLv2 rollback protection↗2021-02-16
▶
OSV
CVE-2021-23839: OpenSSL 1↗2021-02-16
▶

💥Exploits & PoCs

1
Exploit-DB
GetSimple CMS 3.3.16 - Persistent Cross-Site Scripting↗2021-03-30
▶

📋Vendor Advisories

2
Red Hat
openssl: incorrect SSLv2 rollback protection↗2021-02-16
▶
Debian
CVE-2021-23839: openssl - OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a ser...↗2021
▶
CVE-2021-23839 (LOW CVSS 3.7) | OpenSSL 1.0.2 supports SSLv2 | cvebase.io