{ "threat_severity" : "Important", "public_date" : "2021-03-25T00:00:00Z", "bugzilla" : { "description" : "openssl: NULL pointer dereference in signature_algorithms processing", "id" : "1941554", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1941554" }, "cvss3" : { "cvss3_base_score" : "5.9", "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status" : "verified" }, "details" : [ "An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).", "A flaw was found in openssl. A server crash and denial of service attack could occur if a client sends a TLSv1.2 renegotiation ClientHello and omits the signature_algorithms extension but includes a signature_algorithms_cert extension. The highest threat from this vulnerability is to system availability." ], "statement" : "This flaw only affects OpenSSL 1.1.1, older versions are not affected.", "acknowledgement" : "Red Hat would like to thank the OpenSSL project for reporting this issue. Upstream acknowledges Nokia as the original reporter.", "affected_release" : [ { "product_name" : "JBCS 2.4.37 SP7", "release_date" : "2021-04-14T00:00:00Z", "advisory" : "RHSA-2021:1200", "cpe" : "cpe:/a:redhat:jboss_core_services:1", "package" : "openssl" }, { "product_name" : "JBoss Core Services on RHEL 7", "release_date" : "2021-04-14T00:00:00Z", "advisory" : "RHSA-2021:1199", "cpe" : "cpe:/a:redhat:jboss_core_services:1::el7", "package" : "jbcs-httpd24-httpd-0:2.4.37-70.jbcs.el7" }, { "product_name" : "JBoss Core Services on RHEL 7", "release_date" : "2021-04-14T00:00:00Z", "advisory" : "RHSA-2021:1199", "cpe" : "cpe:/a:redhat:jboss_core_services:1::el7", "package" : "jbcs-httpd24-mod_cluster-native-0:1.3.14-20.Final_redhat_2.jbcs.el7" }, { "product_name" : "JBoss Core Services on RHEL 7", "release_date" : "2021-04-14T00:00:00Z", "advisory" : "RHSA-2021:1199", "cpe" : "cpe:/a:redhat:jboss_core_services:1::el7", "package" : "jbcs-httpd24-mod_http2-0:1.15.7-14.jbcs.el7" }, { "product_name" : "JBoss Core Services on RHEL 7", "release_date" : "2021-04-14T00:00:00Z", "advisory" : "RHSA-2021:1199", "cpe" : "cpe:/a:redhat:jboss_core_services:1::el7", "package" : "jbcs-httpd24-mod_jk-0:1.2.48-13.redhat_1.jbcs.el7" }, { "product_name" : "JBoss Core Services on RHEL 7", "release_date" : "2021-04-14T00:00:00Z", "advisory" : "RHSA-2021:1199", "cpe" : "cpe:/a:redhat:jboss_core_services:1::el7", "package" : "jbcs-httpd24-mod_md-1:2.0.8-33.jbcs.el7" }, { "product_name" : "JBoss Core Services on RHEL 7", "release_date" : "2021-04-14T00:00:00Z", "advisory" : "RHSA-2021:1199", "cpe" : "cpe:/a:redhat:jboss_core_services:1::el7", "package" : "jbcs-httpd24-mod_security-0:2.9.2-60.GA.jbcs.el7" }, { "product_name" : "JBoss Core Services on RHEL 7", "release_date" : "2021-04-14T00:00:00Z", "advisory" : "RHSA-2021:1199", "cpe" : "cpe:/a:redhat:jboss_core_services:1::el7", "package" : "jbcs-httpd24-nghttp2-0:1.39.2-37.jbcs.el7" }, { "product_name" : "JBoss Core Services on RHEL 7", "release_date" : "2021-04-14T00:00:00Z", "advisory" : "RHSA-2021:1199", "cpe" : "cpe:/a:redhat:jboss_core_services:1::el7", "package" : "jbcs-httpd24-openssl-1:1.1.1g-6.jbcs.el7" }, { "product_name" : "JBoss Core Services on RHEL 7", "release_date" : "2021-04-14T00:00:00Z", "advisory" : "RHSA-2021:1199", "cpe" : "cpe:/a:redhat:jboss_core_services:1::el7", "package" : "jbcs-httpd24-openssl-chil-0:1.0.0-5.jbcs.el7" }, { "product_name" : "JBoss Core Services on RHEL 7", "release_date" : "2021-04-14T00:00:00Z", "advisory" : "RHSA-2021:1199", "cpe" : "cpe:/a:redhat:jboss_core_services:1::el7", "package" : "jbcs-httpd24-openssl-pkcs11-0:0.4.10-20.jbcs.el7" }, { "product_name" : "Red Hat Enterprise Linux 8", "release_date" : "2021-03-30T00:00:00Z", "advisory" : "RHSA-2021:1024", "cpe" : "cpe:/o:redhat:enterprise_linux:8", "package" : "openssl-1:1.1.1g-15.el8_3" }, { "product_name" : "Red Hat Enterprise Linux 8.1 Extended Update Support", "release_date" : "2021-04-07T00:00:00Z", "advisory" : "RHSA-2021:1131", "cpe" : "cpe:/o:redhat:rhel_eus:8.1", "package" : "openssl-1:1.1.1c-5.el8_1" }, { "product_name" : "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date" : "2021-04-05T00:00:00Z", "advisory" : "RHSA-2021:1063", "cpe" : "cpe:/o:redhat:rhel_eus:8.2", "package" : "openssl-1:1.1.1c-18.el8_2" }, { "product_name" : "Red Hat JBoss Web Server 3.1", "release_date" : "2021-04-14T00:00:00Z", "advisory" : "RHSA-2021:1203", "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:3.1", "package" : "openssl" }, { "product_name" : "Red Hat JBoss Web Server 3 for RHEL 7", "release_date" : "2021-04-14T00:00:00Z", "advisory" : "RHSA-2021:1202", "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el7", "package" : "tomcat-native-0:1.2.23-24.redhat_24.ep7.el7" }, { "product_name" : "Red Hat JBoss Web Server 5", "release_date" : "2021-04-14T00:00:00Z", "advisory" : "RHSA-2021:1196", "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.4" }, { "product_name" : "Red Hat JBoss Web Server 5.4 on RHEL 7", "release_date" : "2021-04-14T00:00:00Z", "advisory" : "RHSA-2021:1195", "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.4::el7", "package" : "jws5-tomcat-native-0:1.2.25-4.redhat_4.el7jws" }, { "product_name" : "Red Hat JBoss Web Server 5.4 on RHEL 8", "release_date" : "2021-04-14T00:00:00Z", "advisory" : "RHSA-2021:1195", "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.4::el8", "package" : "jws5-tomcat-native-0:1.2.25-4.redhat_4.el8jws" }, { "product_name" : "Red Hat Virtualization 4 for Red Hat Enterprise Linux 8", "release_date" : "2021-04-14T00:00:00Z", "advisory" : "RHSA-2021:1189", "cpe" : "cpe:/o:redhat:rhev_hypervisor:4.4::el8", "package" : "redhat-virtualization-host-0:4.4.5-20210330.0.el8_3" } ], "package_state" : [ { "product_name" : "Red Hat Enterprise Linux 6", "fix_state" : "Not affected", "package_name" : "openssl", "cpe" : "cpe:/o:redhat:enterprise_linux:6" }, { "product_name" : "Red Hat Enterprise Linux 6", "fix_state" : "Not affected", "package_name" : "openssl098e", "cpe" : "cpe:/o:redhat:enterprise_linux:6" }, { "product_name" : "Red Hat Enterprise Linux 7", "fix_state" : "Not affected", "package_name" : "openssl", "cpe" : "cpe:/o:redhat:enterprise_linux:7" }, { "product_name" : "Red Hat Enterprise Linux 7", "fix_state" : "Not affected", "package_name" : "openssl098e", "cpe" : "cpe:/o:redhat:enterprise_linux:7" }, { "product_name" : "Red Hat Enterprise Linux 8", "fix_state" : "Not affected", "package_name" : "compat-openssl10", "cpe" : "cpe:/o:redhat:enterprise_linux:8" }, { "product_name" : "Red Hat Enterprise Linux 9", "fix_state" : "Not affected", "package_name" : "openssl", "cpe" : "cpe:/o:redhat:enterprise_linux:9" } ], "references" : [ "https://www.cve.org/CVERecord?id=CVE-2021-3449\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-3449\nhttps://www.openssl.org/news/secadv/20210325.txt" ], "name" : "CVE-2021-3449", "mitigation" : { "value" : "This flaw can be mitigated by disabling TLS renegotiation on servers compiled with OpenSSL. It is enabled by default, but can be disabled for servers which do not require it and can be used to mitigate this flaw. Versions of httpd package shipped with Red Hat Enterprise Linux 8 have TLS renegotiation disabled by default.", "lang" : "en:us" }, "csaw" : false }