CVE-2021-23841

CWE-476 — NULL Pointer DereferenceCWE-190 — Integer Overflow18 documents11 sources
Severity
5.9MEDIUM
EPSS
0.7%
top 28.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
20
Apple IpadosApple Iphone OSApple Macos+17 more
Timeline
PublishedFeb 16
Latest updateOct 15

Description

The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash()…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.2 | Impact: 3.6

Affected Packages24 packages

▶crates.ioopenssl-src0.0.0-0 — 111.14.0+1
▶NVDopenssl/openssl1.0.2 — 1.0.2y+1
▶Debianopenssl< 1.1.1j-1+3
▶Ubuntuopenssl< 1.0.2g-1ubuntu4.19+3
▶Ubuntuopenssl1.0< 1.0.2n-1ubuntu5.6

Also affects: Debian Linux 10.0

Patches

Patch: cert-portal.siemens.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

7
GHSA
Integer Overflow in openssl-src↗2021-08-25
▶
OSV
Integer Overflow in openssl-src↗2021-08-25
▶
OSV
Null pointer deref in `X509_issuer_and_serial_hash()`↗2021-05-01
▶
OSV
openssl vulnerabilities↗2021-02-23
▶
OSV
openssl, openssl1.0 vulnerabilities↗2021-02-18
▶

📋Vendor Advisories

10
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Analytics Server (OpenSSL) — CVE-2021-23841↗2021-10-15
▶
BSD
FreeBSD-SA-21:17.openssl: Multiple vulnerabilities in OpenSSL↗2021-08-24
▶
Apple
CVE-2021-23841: macOS Big Sur 11.4↗2021-05-24
▶
Apple
CVE-2021-23841: Safari 14.1.1↗2021-05-24
▶
Oracle
Oracle Oracle Java SE Risk Matrix: Node (OpenSSL) — CVE-2021-23841↗2021-04-15
▶