Bug 1941554 (CVE-2021-3449)
| Summary: | CVE-2021-3449 openssl: NULL pointer dereference in signature_algorithms processing | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Huzaifa S. Sidhpurwala <huzaifas> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | cfergeau, crypto-team, csutherl, dbelyavs, dblechte, dfediuck, dkuc, dueno, eedri, elima, erik-fedora, fidencio, francois.poirotte, gzaronik, hkario, jclere, joerg.kastning, jwon, kaycoth, krathod, ktietz, marcandre.lureau, mgoldboi, michal.skrivanek, mseri, mturk, pasik, pdwyer, pjindal, redhat-bugzilla, rh-spice-bugs, rjones, sahana, sbonazzo, scott, security-response-team, sherold, ssorce, szappis, tm, vmugicag, yturgema |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | openssl 1.1.1k | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in openssl. A server crash and denial of service attack could occur if a client sends a TLSv1.2 renegotiation ClientHello and omits the signature_algorithms extension but includes a signature_algorithms_cert extension. The highest threat from this vulnerability is to system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-03-30 17:35:18 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1941732, 1941733, 1941734, 1941735, 1941736, 1941737, 1942333, 1942334, 1942335, 1942336, 1942337, 1942338, 1942339, 1942340, 1942341, 1942342, 1943178, 1943179, 1943892 | ||
| Bug Blocks: | 1941549 | ||
|
Description
Huzaifa S. Sidhpurwala
2021-03-22 11:01:07 UTC
Acknowledgments: Name: the OpenSSL project Upstream: Nokia Statement: This flaw only affects OpenSSL 1.1.1, older versions are not affected. External References: https://www.openssl.org/news/secadv/20210325.txt Created openssl tracking bugs for this issue: Affects: fedora-all [bug 1943178] Created openssl11 tracking bugs for this issue: Affects: epel-7 [bug 1943179] stand-alone reproducer: https://github.com/tlsfuzzer/tlsfuzzer/pull/748 Mitigation: This flaw can be mitigated by disabling TLS renegotiation on servers compiled with OpenSSL. It is enabled by default, but can be disabled for servers which do not require it and can be used to mitigate this flaw. Versions of httpd package shipped with Red Hat Enterprise Linux 8 have TLS renegotiation disabled by default. This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:1024 https://access.redhat.com/errata/RHSA-2021:1024 Is this the wrong place to ask when CentOS Stream 8 is going to ship an openssl security update? It has not been updated since December, and is lacking the high severity 1.1.1k fixes (and others of intermediate and low severity). This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-3449 (In reply to Scott Brown from comment #25) > Is this the wrong place to ask when CentOS Stream 8 is going to ship an > openssl security update? It has not been updated since December, and is > lacking the high severity 1.1.1k fixes (and others of intermediate and low > severity). Hi Scott, I'll get back to you on this one. This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Extended Update Support Via RHSA-2021:1063 https://access.redhat.com/errata/RHSA-2021:1063 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Extended Update Support Via RHSA-2021:1131 https://access.redhat.com/errata/RHSA-2021:1131 This issue has been addressed in the following products: Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 Via RHSA-2021:1189 https://access.redhat.com/errata/RHSA-2021:1189 This issue has been addressed in the following products: Red Hat JBoss Web Server Via RHSA-2021:1196 https://access.redhat.com/errata/RHSA-2021:1196 This issue has been addressed in the following products: Red Hat JBoss Web Server 5.4 on RHEL 7 Red Hat JBoss Web Server 5.4 on RHEL 8 Via RHSA-2021:1195 https://access.redhat.com/errata/RHSA-2021:1195 This issue has been addressed in the following products: JBoss Core Services on RHEL 7 Via RHSA-2021:1199 https://access.redhat.com/errata/RHSA-2021:1199 This issue has been addressed in the following products: JBCS 2.4.37 SP7 Via RHSA-2021:1200 https://access.redhat.com/errata/RHSA-2021:1200 This issue has been addressed in the following products: Red Hat JBoss Web Server Via RHSA-2021:1203 https://access.redhat.com/errata/RHSA-2021:1203 This issue has been addressed in the following products: Red Hat JBoss Web Server 3 for RHEL 7 Via RHSA-2021:1202 https://access.redhat.com/errata/RHSA-2021:1202 |