OpenSSL: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• High 7.4
  CVE-2021-3450 Public exploit EPSS 18%

  CA certificate check bypass with X509_V_FLAG_X509_STRICT

  The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded e…

  OpenSSL OpenSSL openssl openssl Debian Alpine crates.io
  Mar 25, 2021
• Medium 5.9
  CVE-2021-3449 Public exploit EPSS 64%

  NULL pointer deref in signature_algorithms processing

  An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a si…

  OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine crates.io
  Mar 25, 2021

Revision history

1. 2024-11-25 #40

   Neue Updates von Oracle Linux aufgenommen

2. 2024-06-04 #39

   Neue Updates von Oracle Linux aufgenommen

3. 2024-03-18 #38

   Neue Updates von Amazon aufgenommen

4. 2023-12-07 #37

   Neue Updates von Oracle Linux aufgenommen

5. 2022-07-13 #36

   Neue Updates von SUSE aufgenommen

6. 2022-05-22 #35

   Neue Updates von HP aufgenommen

7. 2022-03-10 #34

   Neue Updates von Red Hat aufgenommen

8. 2021-09-16 #33

   Neue Updates von Red Hat aufgenommen

9. 2021-08-31 #32

   Neue Updates von Debian aufgenommen

10. 2021-08-12 #31

    Neue Updates von Ubuntu aufgenommen

11. 2021-08-05 #30

    Neue Updates von Red Hat aufgenommen

12. 2021-08-02 #29

    Neue Updates von HCL aufgenommen

13. 2021-07-25 #28

    Neue Updates von HP aufgenommen

14. 2021-07-15 #27

    Neue Updates von SUSE aufgenommen

15. 2021-07-14 #26

    Neue Updates von SUSE aufgenommen

16. 2021-07-13 #25

    Neue Updates von Pulse Secure aufgenommen

17. 2021-06-24 #24

    Neue Updates von Red Hat aufgenommen

18. 2021-06-23 #23

    Neue Updates von Red Hat aufgenommen

19. 2021-06-17 #22

    Neue Updates von Red Hat aufgenommen

20. 2021-06-03 #21

    Neue Updates von HPE aufgenommen

21. 2021-05-20 #20

    Neue Updates von HITACHI aufgenommen

22. 2021-05-18 #19

    Neue Updates von Red Hat aufgenommen

23. 2021-05-16 #18

    Neue Updates von BROCADE aufgenommen

24. 2021-05-11 #17

    Neue Updates von Tenable aufgenommen

25. 2021-04-28 #16

    Neue Updates von Red Hat aufgenommen

References

• OpenSSL Security Advisory 20210325 vom 2021-03-25
  https://www.openssl.org/news/secadv/20210325.txt
• Ubuntu Security Notice USN-4891-1 vom 2021-03-25
  https://ubuntu.com/security/notices/USN-4891-1
• Debian Security Advisory DSA-4875 vom 2021-03-25
  https://www.debian.org/security/2021/dsa-4875
• SUSE Security Update SUSE-SU-2021:0954-1 vom 2021-03-25
  https://lists.suse.com/pipermail/sle-security-updates/2021-March/008558.html
• SUSE Security Update SUSE-SU-2021:0955-1 vom 2021-03-25
  https://lists.suse.com/pipermail/sle-security-updates/2021-March/008559.html
• FreeBSD Security Advisory FreeBSD-SA-21:07.openssl vom 2021-03-25
  https://security.freebsd.org/advisories/FreeBSD-SA-21:07.openssl.asc
• Arch Linux Security Advisory ASA-202103-10 vom 2021-03-25
  https://security.archlinux.org/ASA-202103-10
• Cisco Security Advisory cisco-sa-openssl-2021-GHY28dJd vom 2021-03-25
  https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd
• PoC CVE-2021-3449
  https://github.com/terorie/cve-2021-3449
• Amazon Linux Security Advisory ALAS-2021-1622 vom 2021-03-26
  https://alas.aws.amazon.com/AL2/ALAS-2021-1622.html
• Oracle Linux Security Advisory ELSA-2021-1024 vom 2021-03-30
  https://linux.oracle.com/errata/ELSA-2021-1024.html
• Cisco Security Advisory cisco-sa-openssl-2021-GHY28dJd vom 2021-03-29
  https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd
• Red Hat Security Advisory RHSA-2021:1024 vom 2021-03-30
  https://access.redhat.com/errata/RHSA-2021:1024
• Nessus Network Monitor Security Advisory
  https://de.tenable.com/security/tns-2021-09
• HPE Security Bulletin hpesbst04140en_us vom 2021-06-02
  https://support.hpe.com/hpesc/public/docDisplay?docId=emr_na-hpesbst04140en_us
• Oracle Linux Security Advisory ELSA-2021-9151 vom 2021-04-01
  https://linux.oracle.com/errata/ELSA-2021-9151.html
• Unify Security Advisory Report OBSO-2103-01 vom 2021-03-31
  https://networks.unify.com/security/advisories/OBSO-2103-01.pdf
• Gentoo Linux Security Advisory GLSA-202103-03 vom 2021-03-31
  https://security.gentoo.org/glsa/202103-03
• Cisco Security Advisory cisco-sa-openssl-2021-GHY28dJd vom 2021-03-31
  https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd
• Cisco Security Advisory cisco-sa-openssl-2021-GHY28dJd vom 2021-04-05
  https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd
• Tenable Security Advisory
  https://de.tenable.com/security/tns-2021-05
• Red Hat Security Advisory RHSA-2021:1063 vom 2021-04-05
  https://access.redhat.com/errata/RHSA-2021:1063
• Brocade Security Advisory
  https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1440
• Red Hat Security Advisory RHSA-2021:1131 vom 2021-04-07
  https://access.redhat.com/errata/RHSA-2021:1131
• SUSE Security Update SUSE-SU-2021:1109-1 vom 2021-04-09
  https://lists.suse.com/pipermail/sle-security-updates/2021-April/008603.html
• Tenable Security Advisory
  https://de.tenable.com/security/tns-2021-08
• Red Hat Security Advisory RHSA-2021:1168 vom 2021-04-13
  https://access.redhat.com/errata/RHSA-2021:1168
• AVAYA Security Advisory ASA-2021-025 vom 2021-04-13
  https://downloads.avaya.com/css/P8/documents/101075304
• Red Hat Security Advisory RHSA-2021:1202 vom 2021-04-14
  https://access.redhat.com/errata/RHSA-2021:1202
• Red Hat Security Advisory RHSA-2021:1200 vom 2021-04-14
  https://access.redhat.com/errata/RHSA-2021:1200
• Red Hat Security Advisory RHSA-2021:1199 vom 2021-04-14
  https://access.redhat.com/errata/RHSA-2021:1199
• Red Hat Security Advisory RHSA-2021:1189 vom 2021-04-14
  https://access.redhat.com/errata/RHSA-2021:1189
• Red Hat Security Advisory RHSA-2021:1203 vom 2021-04-14
  https://access.redhat.com/errata/RHSA-2021:1203
• Red Hat Security Advisory RHSA-2021:1196 vom 2021-04-14
  https://access.redhat.com/errata/RHSA-2021:1196
• Red Hat Security Advisory RHSA-2021:1195 vom 2021-04-14
  https://access.redhat.com/errata/RHSA-2021:1195
• McAfee Security Bulletin
  https://kc.mcafee.com/corporate/index?page=content&id=SB10356
• Red Hat Security Advisory RHSA-2021:2041 vom 2021-05-19
  https://access.redhat.com/errata/RHSA-2021:2041
• Meinberg Security Advisory MBGSA-2021.02 vom 2021-04-20
  https://www.meinberg.de/german/news/meinberg-security-advisory-mbgsa-2021-02-meinberg-lantime-firmware-v7-02-003-und-v6-24-028.htm
• Hitachi Vulnerability Information HITACHI-SEC-2021-117 vom 2021-05-21
  https://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2021-117/index.html
• Hitachi Vulnerability Information HITACHI-SEC-2021-119 vom 2021-05-21
  https://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2021-119/index.html
• Meinberg Security Advisory
  https://www.meinberg.de/german/news/meinberg-security-advisory-mbgsa-2021-02-meinberg-lantime-firmware-v7-02-003-und-v6-24-028.htm
• Red Hat Security Advisory RHSA-2021:1338 vom 2021-04-22
  https://access.redhat.com/errata/RHSA-2021:1338
• Red Hat Security Advisory RHSA-2021:1230 vom 2021-04-27
  https://access.redhat.com/errata/RHSA-2021:1230
• Red Hat Security Advisory RHSA-2021:1448 vom 2021-04-28
  https://access.redhat.com/errata/RHSA-2021:1448
• Red Hat Security Advisory RHSA-2021:2479 vom 2021-06-17
  https://access.redhat.com/errata/RHSA-2021:2479
• Red Hat Security Advisory RHSA-2021:2532 vom 2021-06-23
  https://access.redhat.com/errata/RHSA-2021:2532
• Red Hat Security Advisory RHSA-2021:2543 vom 2021-06-24
  https://access.redhat.com/errata/RHSA-2021:2543
• Pulse Secure Security Advisory SA44845 vom 2021-07-14
  https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845/?kA23Z000000L6ooSAC=
• SUSE Security Update SUSE-SU-2021:2326-1 vom 2021-07-14
  https://lists.suse.com/pipermail/sle-security-updates/2021-July/009136.html
• SUSE Security Update SUSE-SU-2021:2323-1 vom 2021-07-14
  https://lists.suse.com/pipermail/sle-security-updates/2021-July/009135.html
• SUSE Security Update SUSE-SU-2021:2327-1 vom 2021-07-14
  https://lists.suse.com/pipermail/sle-security-updates/2021-July/009139.html
• SUSE Security Update SUSE-SU-2021:2353-1 vom 2021-07-15
  https://lists.suse.com/pipermail/sle-security-updates/2021-July/009145.html
• HPE Security Bulletin
  https://support.hpe.com/hpesc/public/docDisplay?docId=emr_na-hpesbst04142en_us
• HCL Article KB0090800 vom 2021-08-03
  https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0090800
• Red Hat Security Advisory RHSA-2021:3016 vom 2021-08-06
  https://access.redhat.com/errata/RHSA-2021:3016
• Ubuntu Security Notice USN-5038-1 vom 2021-08-12
  https://ubuntu.com/security/notices/USN-5038-1
• Debian Security Advisory DLA-2751 vom 2021-08-31
  https://lists.debian.org/debian-lts-announce/2021/08/msg00029.html
• Red Hat Security Advisory RHSA-2021:3556 vom 2021-09-17
  https://access.redhat.com/errata/RHSA-2021:3556
• Red Hat Security Advisory RHSA-2022:0056 vom 2022-03-10
  https://access.redhat.com/errata/RHSA-2022:0056
• HPE Security Bulletin
  https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbux04309en_us&hprpt_id=ALERT_HPE_3024068&jumpid=em_pom8nu6hj_aid-520066529
• SUSE Security Update SUSE-SU-2021:0955-2 vom 2022-07-13
  https://lists.suse.com/pipermail/sle-security-updates/2022-July/011541.html
• Oracle Linux Security Advisory ELSA-2023-13026 vom 2023-12-07
  https://linux.oracle.com/errata/ELSA-2023-13026.html
• Oracle Linux Security Advisory ELSA-2023-13024 vom 2023-12-07
  https://linux.oracle.com/errata/ELSA-2023-13024.html
• Oracle Linux Security Advisory ELSA-2023-13025 vom 2023-12-07
  https://linux.oracle.com/errata/ELSA-2023-13025.html
• Oracle Linux Security Advisory ELSA-2023-32791 vom 2023-12-07
  https://linux.oracle.com/errata/ELSA-2023-32791.html
• Oracle Linux Security Advisory ELSA-2023-32790 vom 2023-12-07
  https://linux.oracle.com/errata/ELSA-2023-32790.html
• Oracle Linux Security Advisory ELSA-2023-13027 vom 2023-12-07
  https://linux.oracle.com/errata/ELSA-2023-13027.html
• Amazon Linux Security Advisory ALAS-2024-2502 vom 2024-03-19
  https://alas.aws.amazon.com/AL2/ALAS-2024-2502.html
• Oracle Linux Security Advisory ELSA-2024-12408 vom 2024-06-05
  https://linux.oracle.com/errata/ELSA-2024-12408.html
• Oracle Linux Security Advisory ELSA-2024-12842 vom 2024-11-25
  https://linux.oracle.com/errata/ELSA-2024-12842.html