Skip to content
OpenAdvisories
Medium USN-4745-1 2 CVEs

openssl vulnerabilities

Published Feb 23, 2021 · Updated Jun 1, 2026

Ecosystem: Ubuntu

Summary

David Benjamin discovered that OpenSSL incorrectly handled comparing
certificates containing a EDIPartyName name type. A remote attacker could
possibly use this issue to cause OpenSSL to crash, resulting in a denial of
service. (CVE-2020-1971)

Tavis Ormandy discovered that OpenSSL incorrectly handled parsing issuer
fields. A remote attacker could possibly use this issue to cause OpenSSL to
crash, resulting in a denial of service. (CVE-2021-23841)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS openssl 1.0.1f-1ubuntu2.27+esm2

Vulnerabilities 2

  • Medium 5.9
    CVE-2020-1971 Public exploit

    EDIPARTYNAME NULL pointer dereference

    The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equa…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine
  • Medium 5.9
    CVE-2021-23841 Public exploit

    Null pointer deref in X509_issuer_and_serial_hash()

    The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing …

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine crates.io

References

  • report
    https://ubuntu.com/security/CVE-2020-1971
  • report
    https://ubuntu.com/security/CVE-2021-23841