Skip to content
OpenAdvisories
High ELSA-2021-1024 2 CVEs

Important: openssl security update (Oracle Linux 8)

Published Mar 29, 2021 · Updated Mar 29, 2021

Ecosystem: Oracle Linux

Summary

[1.1.1g-15]
- version bump

[1.1.1g-14]
- CVE-2021-3450 openssl: CA certificate check
bypass with X509_V_FLAG_X509_STRICT

[1.1.1g-13]
- Fix CVE-2021-3449 NULL pointer deref in signature_algorithms processing

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 8 openssl 1:1.1.1g-15.el8_3
Oracle Linux · 8 openssl-devel 1:1.1.1g-15.el8_3
Oracle Linux · 8 openssl-libs 1:1.1.1g-15.el8_3
Oracle Linux · 8 openssl-perl 1:1.1.1g-15.el8_3

Vulnerabilities 2

  • High 7.4
    CVE-2021-3450 Public exploit EPSS 18%

    CA certificate check bypass with X509_V_FLAG_X509_STRICT

    The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded e…

    OpenSSL OpenSSL openssl openssl Debian Alpine crates.io
  • Medium 5.9
    CVE-2021-3449 Public exploit EPSS 64%

    NULL pointer deref in signature_algorithms processing

    An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a si…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine crates.io