Skip to content
OpenAdvisories
Medium USN-4891-1 1 CVE

openssl vulnerability

Published Mar 25, 2021 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that OpenSSL incorrectly handled certain renegotiation
ClientHello messages. A remote attacker could use this issue to cause
OpenSSL to crash, resulting in a denial of service.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS openssl 1.1.1-1ubuntu2.1~18.04.9
Ubuntu · 20.04 LTS 20.04:LTS openssl 1.1.1f-1ubuntu2.3

Vulnerabilities 1

  • Medium 5.9
    CVE-2021-3449 Public exploit EPSS 64%

    NULL pointer deref in signature_algorithms processing

    An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a si…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine crates.io

References

  • report
    https://ubuntu.com/security/CVE-2021-3449