CVE Feed

    Dashboard / CVE / CVE-2021-3449

    CVE-2021-3449

    An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).

    Published:Mar 25, 2021
    Last Modified:Nov 21, 2024
    EPS:Mar 25, 2021
    EPSS Score:0.10687
    CVSS Score:5.9

    Affected Products

    Vendor
    Checkpoint
    Product
    Multi-domain Management
    Vendor
    Checkpoint
    Product
    Multi-domain Management Firmware
    Vendor
    Checkpoint
    Product
    Quantum Security Gateway
    Vendor
    Checkpoint
    Product
    Quantum Security Gateway Firmware
    Vendor
    Checkpoint
    Product
    Quantum Security Management
    Vendor
    Checkpoint
    Product
    Quantum Security Management Firmware
    Vendor
    Debian
    Product
    Debian Linux
    Vendor
    Fedoraproject
    Product
    Fedora
    Vendor
    Freebsd
    Product
    Freebsd
    Vendor
    Mcafee
    Product
    Web Gateway
    Vendor
    Mcafee
    Product
    Web Gateway Cloud Service
    Vendor
    Netapp
    Product
    Active Iq Unified Manager
    Vendor
    Netapp
    Product
    Cloud Volumes Ontap Mediator
    Vendor
    Netapp
    Product
    E-series Performance Analyzer
    Vendor
    Netapp
    Product
    Oncommand Insight
    Vendor
    Netapp
    Product
    Oncommand Workflow Automation
    Vendor
    Netapp
    Product
    Ontap Select Deploy Administration Utility
    Vendor
    Netapp
    Product
    Santricity Smi-s Provider
    Vendor
    Netapp
    Product
    Snapcenter
    Vendor
    Netapp
    Product
    Storagegrid
    Vendor
    Nodejs
    Product
    Node.js
    Vendor
    Openssl
    Product
    Openssl
    Vendor
    Oracle
    Product
    Communications Communications Policy Management
    Vendor
    Oracle
    Product
    Enterprise Manager For Storage Management
    Vendor
    Oracle
    Product
    Essbase
    Vendor
    Oracle
    Product
    Graalvm
    Vendor
    Oracle
    Product
    Jd Edwards Enterpriseone Tools
    Vendor
    Oracle
    Product
    Jd Edwards World Security
    Vendor
    Oracle
    Product
    Mysql Connectors
    Vendor
    Oracle
    Product
    Mysql Server
    Vendor
    Oracle
    Product
    Mysql Workbench
    Vendor
    Oracle
    Product
    Peoplesoft Enterprise Peopletools
    Vendor
    Oracle
    Product
    Primavera Unifier
    Vendor
    Oracle
    Product
    Secure Backup
    Vendor
    Oracle
    Product
    Secure Global Desktop
    Vendor
    Oracle
    Product
    Zfs Storage Appliance Kit
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Jboss Core Services
    Vendor
    Redhat
    Product
    Jboss Enterprise Web Server
    Vendor
    Redhat
    Product
    Rhel Eus
    Vendor
    Redhat
    Product
    Rhev Hypervisor
    Vendor
    Siemens
    Product
    Ruggedcom Rcm1224
    Vendor
    Siemens
    Product
    Ruggedcom Rcm1224 Firmware
    Vendor
    Siemens
    Product
    Scalance Lpe9403
    Vendor
    Siemens
    Product
    Scalance Lpe9403 Firmware
    Vendor
    Siemens
    Product
    Scalance M-800
    Vendor
    Siemens
    Product
    Scalance M-800 Firmware
    Vendor
    Siemens
    Product
    Scalance S602
    Vendor
    Siemens
    Product
    Scalance S602 Firmware
    Vendor
    Siemens
    Product
    Scalance S612
    Vendor
    Siemens
    Product
    Scalance S612 Firmware
    Vendor
    Siemens
    Product
    Scalance S615
    Vendor
    Siemens
    Product
    Scalance S615 Firmware
    Vendor
    Siemens
    Product
    Scalance S623
    Vendor
    Siemens
    Product
    Scalance S623 Firmware
    Vendor
    Siemens
    Product
    Scalance S627-2m
    Vendor
    Siemens
    Product
    Scalance S627-2m Firmware
    Vendor
    Siemens
    Product
    Scalance Sc-600
    Vendor
    Siemens
    Product
    Scalance Sc-600 Firmware
    Vendor
    Siemens
    Product
    Scalance W1700
    Vendor
    Siemens
    Product
    Scalance W1700 Firmware
    Vendor
    Siemens
    Product
    Scalance W700
    Vendor
    Siemens
    Product
    Scalance W700 Firmware
    Vendor
    Siemens
    Product
    Scalance Xb-200
    Vendor
    Siemens
    Product
    Scalance Xb-200 Firmware
    Vendor
    Siemens
    Product
    Scalance Xc-200
    Vendor
    Siemens
    Product
    Scalance Xc-200 Firmware
    Vendor
    Siemens
    Product
    Scalance Xf-200ba
    Vendor
    Siemens
    Product
    Scalance Xf-200ba Firmware
    Vendor
    Siemens
    Product
    Scalance Xm-400
    Vendor
    Siemens
    Product
    Scalance Xm-400 Firmware
    Vendor
    Siemens
    Product
    Scalance Xp-200
    Vendor
    Siemens
    Product
    Scalance Xp-200 Firmware
    Vendor
    Siemens
    Product
    Scalance Xr-300wg
    Vendor
    Siemens
    Product
    Scalance Xr-300wg Firmware
    Vendor
    Siemens
    Product
    Scalance Xr524-8c
    Vendor
    Siemens
    Product
    Scalance Xr524-8c Firmware
    Vendor
    Siemens
    Product
    Scalance Xr526-8c
    Vendor
    Siemens
    Product
    Scalance Xr526-8c Firmware
    Vendor
    Siemens
    Product
    Scalance Xr528-6m
    Vendor
    Siemens
    Product
    Scalance Xr528-6m Firmware
    Vendor
    Siemens
    Product
    Scalance Xr552-12
    Vendor
    Siemens
    Product
    Scalance Xr552-12 Firmware
    Vendor
    Siemens
    Product
    Simatic Cloud Connect 7
    Vendor
    Siemens
    Product
    Simatic Cloud Connect 7 Firmware
    Vendor
    Siemens
    Product
    Simatic Cp 1242-7 Gprs V2
    Vendor
    Siemens
    Product
    Simatic Cp 1242-7 Gprs V2 Firmware
    Vendor
    Siemens
    Product
    Simatic Hmi Basic Panels 2nd Generation
    Vendor
    Siemens
    Product
    Simatic Hmi Basic Panels 2nd Generation Firmware
    Vendor
    Siemens
    Product
    Simatic Hmi Comfort Outdoor Panels
    Vendor
    Siemens
    Product
    Simatic Hmi Comfort Outdoor Panels Firmware
    Vendor
    Siemens
    Product
    Simatic Hmi Ktp Mobile Panels
    Vendor
    Siemens
    Product
    Simatic Hmi Ktp Mobile Panels Firmware
    Vendor
    Siemens
    Product
    Simatic Logon
    Vendor
    Siemens
    Product
    Simatic Mv500
    Vendor
    Siemens
    Product
    Simatic Mv500 Firmware
    Vendor
    Siemens
    Product
    Simatic Net Cp1243-7 Lte Eu
    Vendor
    Siemens
    Product
    Simatic Net Cp1243-7 Lte Eu Firmware
    Vendor
    Siemens
    Product
    Simatic Net Cp1243-7 Lte Us
    Vendor
    Siemens
    Product
    Simatic Net Cp1243-7 Lte Us Firmware
    Vendor
    Siemens
    Product
    Simatic Net Cp 1243-1
    Vendor
    Siemens
    Product
    Simatic Net Cp 1243-1 Firmware
    Vendor
    Siemens
    Product
    Simatic Net Cp 1243-8 Irc
    Vendor
    Siemens
    Product
    Simatic Net Cp 1243-8 Irc Firmware
    Vendor
    Siemens
    Product
    Simatic Net Cp 1542sp-1 Irc
    Vendor
    Siemens
    Product
    Simatic Net Cp 1542sp-1 Irc Firmware
    Vendor
    Siemens
    Product
    Simatic Net Cp 1543-1
    Vendor
    Siemens
    Product
    Simatic Net Cp 1543-1 Firmware
    Vendor
    Siemens
    Product
    Simatic Net Cp 1543sp-1
    Vendor
    Siemens
    Product
    Simatic Net Cp 1543sp-1 Firmware
    Vendor
    Siemens
    Product
    Simatic Net Cp 1545-1
    Vendor
    Siemens
    Product
    Simatic Net Cp 1545-1 Firmware
    Vendor
    Siemens
    Product
    Simatic Pcs 7 Telecontrol
    Vendor
    Siemens
    Product
    Simatic Pcs 7 Telecontrol Firmware
    Vendor
    Siemens
    Product
    Simatic Pcs Neo
    Vendor
    Siemens
    Product
    Simatic Pcs Neo Firmware
    Vendor
    Siemens
    Product
    Simatic Pdm
    Vendor
    Siemens
    Product
    Simatic Pdm Firmware
    Vendor
    Siemens
    Product
    Simatic Process Historian Opc Ua Server
    Vendor
    Siemens
    Product
    Simatic Process Historian Opc Ua Server Firmware
    Vendor
    Siemens
    Product
    Simatic Rf166c
    Vendor
    Siemens
    Product
    Simatic Rf166c Firmware
    Vendor
    Siemens
    Product
    Simatic Rf185c
    Vendor
    Siemens
    Product
    Simatic Rf185c Firmware
    Vendor
    Siemens
    Product
    Simatic Rf186c
    Vendor
    Siemens
    Product
    Simatic Rf186c Firmware
    Vendor
    Siemens
    Product
    Simatic Rf186ci
    Vendor
    Siemens
    Product
    Simatic Rf186ci Firmware
    Vendor
    Siemens
    Product
    Simatic Rf188c
    Vendor
    Siemens
    Product
    Simatic Rf188c Firmware
    Vendor
    Siemens
    Product
    Simatic Rf188ci
    Vendor
    Siemens
    Product
    Simatic Rf188ci Firmware
    Vendor
    Siemens
    Product
    Simatic Rf360r
    Vendor
    Siemens
    Product
    Simatic Rf360r Firmware
    Vendor
    Siemens
    Product
    Simatic S7-1200 Cpu 1211c
    Vendor
    Siemens
    Product
    Simatic S7-1200 Cpu 1211c Firmware
    Vendor
    Siemens
    Product
    Simatic S7-1200 Cpu 1212c
    Vendor
    Siemens
    Product
    Simatic S7-1200 Cpu 1212c Firmware
    Vendor
    Siemens
    Product
    Simatic S7-1200 Cpu 1212fc
    Vendor
    Siemens
    Product
    Simatic S7-1200 Cpu 1212fc Firmware
    Vendor
    Siemens
    Product
    Simatic S7-1200 Cpu 1214 Fc
    Vendor
    Siemens
    Product
    Simatic S7-1200 Cpu 1214 Fc Firmware
    Vendor
    Siemens
    Product
    Simatic S7-1200 Cpu 1214c
    Vendor
    Siemens
    Product
    Simatic S7-1200 Cpu 1214c Firmware
    Vendor
    Siemens
    Product
    Simatic S7-1200 Cpu 1215 Fc
    Vendor
    Siemens
    Product
    Simatic S7-1200 Cpu 1215 Fc Firmware
    Vendor
    Siemens
    Product
    Simatic S7-1200 Cpu 1215c
    Vendor
    Siemens
    Product
    Simatic S7-1200 Cpu 1215c Firmware
    Vendor
    Siemens
    Product
    Simatic S7-1200 Cpu 1217c
    Vendor
    Siemens
    Product
    Simatic S7-1200 Cpu 1217c Firmware
    Vendor
    Siemens
    Product
    Simatic S7-1500 Cpu 1518-4 Pn\/dp Mfp
    Vendor
    Siemens
    Product
    Simatic S7-1500 Cpu 1518-4 Pn\/dp Mfp Firmware
    Vendor
    Siemens
    Product
    Simatic Wincc Runtime Advanced
    Vendor
    Siemens
    Product
    Simatic Wincc Telecontrol
    Vendor
    Siemens
    Product
    Sinamics Connect 300
    Vendor
    Siemens
    Product
    Sinamics Connect 300 Firmware
    Vendor
    Siemens
    Product
    Sinec Infrastructure Network Services
    Vendor
    Siemens
    Product
    Sinec Nms
    Vendor
    Siemens
    Product
    Sinec Pni
    Vendor
    Siemens
    Product
    Sinema Server
    Vendor
    Siemens
    Product
    Sinumerik Opc Ua Server
    Vendor
    Siemens
    Product
    Tia Administrator
    Vendor
    Siemens
    Product
    Tim 1531 Irc
    Vendor
    Siemens
    Product
    Tim 1531 Irc Firmware
    Vendor
    Sonicwall
    Product
    Capture Client
    Vendor
    Sonicwall
    Product
    Sma100
    Vendor
    Sonicwall
    Product
    Sma100 Firmware
    Vendor
    Sonicwall
    Product
    Sonicos
    Vendor
    Tenable
    Product
    Log Correlation Engine
    Vendor
    Tenable
    Product
    Nessus
    Vendor
    Tenable
    Product
    Nessus Network Monitor
    Vendor
    Tenable
    Product
    Tenable.sc

    Exploits

    https://github.com/riptl/cve-2021-3449

    Common Weakness Enumeration

    CWE-476 NULL Pointer Dereference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    References

    http://www.openwall.com/lists/oss-security/2021/03/27/1
    http://www.openwall.com/lists/oss-security/2021/03/27/2
    http://www.openwall.com/lists/oss-security/2021/03/28/3
    http://www.openwall.com/lists/oss-security/2021/03/28/4
    https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
    https://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf
    https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fb9fa6b51defd48157eeb207f52181f735d96148
    https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845
    https://kc.mcafee.com/corporate/index?page=content&id=SB10356
    https://lists.debian.org/debian-lts-announce/2021/08/msg00029.html
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/
    https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013
    https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc
    https://security.gentoo.org/glsa/202103-03
    https://security.netapp.com/advisory/ntap-20210326-0006/
    https://security.netapp.com/advisory/ntap-20210513-0002/
    https://security.netapp.com/advisory/ntap-20240621-0006/
    https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd
    https://www.debian.org/security/2021/dsa-4875
    https://www.openssl.org/news/secadv/20210325.txt
    https://www.oracle.com//security-alerts/cpujul2021.html
    https://www.oracle.com/security-alerts/cpuApr2021.html
    https://www.oracle.com/security-alerts/cpuapr2022.html
    https://www.oracle.com/security-alerts/cpujul2022.html
    https://www.oracle.com/security-alerts/cpuoct2021.html
    https://www.tenable.com/security/tns-2021-05
    https://www.tenable.com/security/tns-2021-06
    https://www.tenable.com/security/tns-2021-09
    https://www.tenable.com/security/tns-2021-10
    http://www.openwall.com/lists/oss-security/2021/03/27/1
    http://www.openwall.com/lists/oss-security/2021/03/27/2
    http://www.openwall.com/lists/oss-security/2021/03/28/3
    http://www.openwall.com/lists/oss-security/2021/03/28/4
    https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
    https://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf
    https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fb9fa6b51defd48157eeb207f52181f735d96148
    https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845
    https://kc.mcafee.com/corporate/index?page=content&id=SB10356
    https://lists.debian.org/debian-lts-announce/2021/08/msg00029.html
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/
    https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013
    https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc
    https://security.gentoo.org/glsa/202103-03
    https://security.netapp.com/advisory/ntap-20210326-0006/
    https://security.netapp.com/advisory/ntap-20210513-0002/
    https://security.netapp.com/advisory/ntap-20240621-0006/
    https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd
    https://www.debian.org/security/2021/dsa-4875
    https://www.openssl.org/news/secadv/20210325.txt
    https://www.oracle.com//security-alerts/cpujul2021.html
    https://www.oracle.com/security-alerts/cpuApr2021.html
    https://www.oracle.com/security-alerts/cpuapr2022.html
    https://www.oracle.com/security-alerts/cpujul2022.html
    https://www.oracle.com/security-alerts/cpuoct2021.html
    https://www.tenable.com/security/tns-2021-05
    https://www.tenable.com/security/tns-2021-06
    https://www.tenable.com/security/tns-2021-09
    https://www.tenable.com/security/tns-2021-10

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High