CVE-2021-3450

7.4

HIGH

Apache OpenSSL Elliptic Curve Parameter Validation Bypass

Description

The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a "purpose" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named "purpose" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j).

INFO

Published Date :

March 25, 2021, 3:15 p.m.

Last Modified :

Nov. 7, 2023, 3:38 a.m.

Source :

[email protected]

Remotely Exploitable :

Yes !

Impact Score :

5.2

Exploitability Score :

2.2 Public PoC/Exploit Available at Github

CVE-2021-3450 has a 13 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2021-3450 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Oracle	weblogic_server
2	Oracle	peoplesoft_enterprise_peopletools
3	Oracle	commerce_guided_search
4	Oracle	jd_edwards_enterpriseone_tools
5	Oracle	mysql_enterprise_monitor
6	Oracle	mysql_workbench
7	Oracle	secure_backup
8	Oracle	secure_global_desktop
9	Oracle	graalvm
10	Oracle	mysql_server
11	Oracle	mysql_connectors
12	Oracle	enterprise_manager_for_storage_management
13	Oracle	jd_edwards_world_security
1	Netapp	ontap_select_deploy_administration_utility
2	Netapp	oncommand_workflow_automation
3	Netapp	storagegrid
4	Netapp	cloud_volumes_ontap_mediator
5	Netapp	santricity_smi-s_provider_firmware
6	Netapp	storagegrid_firmware
1	Sonicwall	sonicos
2	Sonicwall	email_security
3	Sonicwall	sma100_firmware
4	Sonicwall	capture_client
1	Tenable	nessus
2	Tenable	nessus_agent
3	Tenable	nessus_network_monitor
1	Mcafee	web_gateway
2	Mcafee	web_gateway_cloud_service
1	Fedoraproject	fedora
1	Openssl	openssl
1	Freebsd	freebsd
1	Nodejs	node.js
1	Windriver	linux

: Total Affected Vendor : 10 | Products : 33

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2021-3450.

URL	Resource
http://www.openwall.com/lists/oss-security/2021/03/27/1	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/03/27/2	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/03/28/3	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/03/28/4	Mailing List Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf	Third Party Advisory
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2a40b7bc7b94dd7de897a74571e7024f0cf0d63b
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845	Third Party Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10356	Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/
https://mta.openssl.org/pipermail/openssl-announce/2021-March/000198.html	Mailing List Vendor Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013	Third Party Advisory
https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc	Third Party Advisory
https://security.gentoo.org/glsa/202103-03	Third Party Advisory
https://security.netapp.com/advisory/ntap-20210326-0006/	Third Party Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd	Third Party Advisory
https://www.openssl.org/news/secadv/20210325.txt	Vendor Advisory
https://www.oracle.com//security-alerts/cpujul2021.html	Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html	Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html	Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html	Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html	Patch Third Party Advisory
https://www.tenable.com/security/tns-2021-05	Third Party Advisory
https://www.tenable.com/security/tns-2021-08	Third Party Advisory
https://www.tenable.com/security/tns-2021-09	Third Party Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

ARPSyndicate/docs

Official API Documentation

Updated: 2 months, 3 weeks ago

8 stars 0 fork 0 watcher

Born at : July 5, 2024, 8:57 p.m. This repo has been linked 2 different CVEs too.

ARPSyndicate/puncia

The Panthera(P.)uncia of Cybersecurity - Official CLI utility for Subdomain Center & Exploit Observer.

arpsyndicate exploit subdomain

Python

Updated: 4 months, 3 weeks ago

623 stars 31 fork 31 watcher

Born at : Sept. 10, 2023, 1:10 p.m. This repo has been linked 2 different CVEs too.

fredrkl/trivy-demo

Demo repository showcasing some of the possibilities of Aqua Trivy.

cncf-demo trivy

Dockerfile Shell

Updated: 1 year, 3 months ago

0 stars 0 fork 0 watcher

Born at : May 6, 2023, 9:42 a.m. This repo has been linked 27 different CVEs too.

chnzzh/OpenSSL-CVE-lib

None

Updated: 2 months, 1 week ago

5 stars 0 fork 0 watcher

Born at : Feb. 23, 2023, 5:42 a.m. This repo has been linked 455 different CVEs too.

teresaweber685/book_list

工具书单

Perl Shell

Updated: 1 year, 9 months ago

0 stars 0 fork 0 watcher

Born at : Feb. 7, 2023, 6:29 a.m. This repo has been linked 20 different CVEs too.

tianocore-docs/ThirdPartySecurityAdvisories

Third party components security advisories

HTML CSS

Updated: 1 year, 4 months ago

1 stars 0 fork 0 watcher

Born at : July 18, 2022, 7:03 p.m. This repo has been linked 9 different CVEs too.

thecyberbaby/Trivy-by-AquaSecurity

A security framework by Aquasecurity

Updated: 2 years, 4 months ago

0 stars 0 fork 0 watcher

Born at : June 22, 2022, 10:40 a.m. This repo has been linked 16 different CVEs too.

jntass/TASSL-1.1.1k

此仓库已停止维护，请移步https://github.com/jntass/TASSL-1.1.1

Perl DIGITAL Command Language C Shell Assembly M4 eC Python C++ sed

Updated: 8 months, 2 weeks ago

54 stars 16 fork 16 watcher

Born at : Nov. 24, 2021, 6:39 a.m. This repo has been linked 13 different CVEs too.

vinamra28/tekton-image-scan-trivy

None

Updated: 3 years, 1 month ago

0 stars 0 fork 0 watcher

Born at : Sept. 26, 2021, 12:33 p.m. This repo has been linked 17 different CVEs too.

rnbochsr/yr_of_the_jellyfish

My notes from the TryHackMe Year of the Jellyfish room giveaway.

Python

Updated: 1 year, 4 months ago

1 stars 0 fork 0 watcher

Born at : April 24, 2021, 6:27 p.m. This repo has been linked 9 different CVEs too.

scriptzteam/glFTPd-v2.11ab-STABLE

Compiled against Openssl 1.1.1k

Shell C Tcl C++ Perl HTML

Updated: 3 years, 7 months ago

1 stars 0 fork 0 watcher

Born at : April 5, 2021, 9:46 a.m. This repo has been linked 2 different CVEs too.

DNTYO/F5_Vulnerability

None

Updated: 3 years, 1 month ago

1 stars 0 fork 0 watcher

Born at : March 21, 2021, 3:33 a.m. This repo has been linked 73 different CVEs too.

isgo-golgo13/gokit-gorillakit-enginesvc

Docker/K8s Engine Microservice using Go kit and Gorilla (Go Web Toolkit Toolkit). Project includes K8s packages for K8s-YAML, K8s-Helm3 and K8s-Kustomize

Dockerfile Go Makefile Smarty

Updated: 1 year, 6 months ago

1 stars 0 fork 0 watcher

Born at : Nov. 27, 2019, 4:08 a.m. This repo has been linked 27 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2021-3450 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2021-3450 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

Action	Type	Old Value	New Value
Added	Reference		OpenSSL Software Foundation https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2a40b7bc7b94dd7de897a74571e7024f0cf0d63b [No types assigned]
Added	Reference		OpenSSL Software Foundation https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/ [No types assigned]
Removed	Reference	OpenSSL Software Foundation https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2a40b7bc7b94dd7de897a74571e7024f0cf0d63b
Removed	Reference	OpenSSL Software Foundation https://lists.fedoraproject.org/archives/list/[email protected]/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/

Action	Type	Old Value	New Value
Changed	Reference Type	https://lists.fedoraproject.org/archives/list/[email protected]/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/ Third Party Advisory	https://lists.fedoraproject.org/archives/list/[email protected]/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/ Mailing List, Third Party Advisory
Changed	Reference Type	https://www.oracle.com//security-alerts/cpujul2021.html Third Party Advisory	https://www.oracle.com//security-alerts/cpujul2021.html Patch, Third Party Advisory
Changed	Reference Type	https://www.oracle.com/security-alerts/cpuapr2022.html Third Party Advisory	https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
Changed	Reference Type	https://www.oracle.com/security-alerts/cpujul2022.html No Types Assigned	https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory
Changed	Reference Type	https://www.oracle.com/security-alerts/cpuoct2021.html Third Party Advisory	https://www.oracle.com/security-alerts/cpuoct2021.html Patch, Third Party Advisory
Changed	CPE Configuration	OR cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.4.0.0::::::: cpe:2.3:a:oracle:graalvm:19.3.5::::enterprise:::* cpe:2.3:a:oracle:graalvm:20.3.1.2::::enterprise:::* cpe:2.3:a:oracle:graalvm:21.0.0.2::::enterprise:::* cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools::::::::* versions up to (excluding) 9.2.6.0 cpe:2.3:a:oracle:jd_edwards_world_security:a9.4::::::: cpe:2.3:a:oracle:mysql_connectors::::::::* versions up to (including) 8.0.23 cpe:2.3:a:oracle:mysql_enterprise_monitor::::::::* versions up to (including) 8.0.23 cpe:2.3:a:oracle:mysql_server::::::::* versions up to (including) 5.7.33 cpe:2.3:a:oracle:mysql_server::::::::* versions from (including) 8.0.15 up to (including) 8.0.23 cpe:2.3:a:oracle:mysql_workbench::::::::* versions up to (including) 8.0.23 cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools::::::::* versions from (including) 8.57 up to (including) 8.59 cpe:2.3:a:oracle:secure_backup::::::::* versions up to (excluding) 18.1.0.1.0 cpe:2.3:a:oracle:secure_global_desktop:5.6:::::::	OR cpe:2.3:a:oracle:commerce_guided_search:11.3.2::::::: cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.4.0.0::::::: cpe:2.3:a:oracle:graalvm:19.3.5::::enterprise:::* cpe:2.3:a:oracle:graalvm:20.3.1.2::::enterprise:::* cpe:2.3:a:oracle:graalvm:21.0.0.2::::enterprise:::* cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools::::::::* versions up to (excluding) 9.2.6.0 cpe:2.3:a:oracle:jd_edwards_world_security:a9.4::::::: cpe:2.3:a:oracle:mysql_connectors::::::::* versions up to (including) 8.0.23 cpe:2.3:a:oracle:mysql_enterprise_monitor::::::::* versions up to (including) 8.0.23 cpe:2.3:a:oracle:mysql_server::::::::* versions up to (including) 5.7.33 cpe:2.3:a:oracle:mysql_server::::::::* versions from (including) 8.0.15 up to (including) 8.0.23 cpe:2.3:a:oracle:mysql_workbench::::::::* versions up to (including) 8.0.23 cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools::::::::* versions from (including) 8.57 up to (including) 8.59 cpe:2.3:a:oracle:secure_backup::::::::* versions up to (excluding) 18.1.0.1.0 cpe:2.3:a:oracle:secure_global_desktop:5.6::::::: cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0::::::: cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:::::::

Action	Type	Old Value	New Value
Added	CVSS V2		NIST (AV:N/AC:M/Au:N/C:P/I:P/A:N)
Added	CVSS V3.1		NIST AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Changed	Reference Type	http://www.openwall.com/lists/oss-security/2021/03/27/1 No Types Assigned	http://www.openwall.com/lists/oss-security/2021/03/27/1 Mailing List, Third Party Advisory
Changed	Reference Type	http://www.openwall.com/lists/oss-security/2021/03/27/2 No Types Assigned	http://www.openwall.com/lists/oss-security/2021/03/27/2 Mailing List, Third Party Advisory
Changed	Reference Type	http://www.openwall.com/lists/oss-security/2021/03/28/3 No Types Assigned	http://www.openwall.com/lists/oss-security/2021/03/28/3 Mailing List, Third Party Advisory
Changed	Reference Type	http://www.openwall.com/lists/oss-security/2021/03/28/4 No Types Assigned	http://www.openwall.com/lists/oss-security/2021/03/28/4 Mailing List, Third Party Advisory
Changed	Reference Type	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2a40b7bc7b94dd7de897a74571e7024f0cf0d63b No Types Assigned	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2a40b7bc7b94dd7de897a74571e7024f0cf0d63b Mailing List, Patch, Vendor Advisory
Changed	Reference Type	https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc No Types Assigned	https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc Third Party Advisory
Changed	Reference Type	https://security.gentoo.org/glsa/202103-03 No Types Assigned	https://security.gentoo.org/glsa/202103-03 Third Party Advisory
Changed	Reference Type	https://security.netapp.com/advisory/ntap-20210326-0006/ No Types Assigned	https://security.netapp.com/advisory/ntap-20210326-0006/ Third Party Advisory
Changed	Reference Type	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd No Types Assigned	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd Third Party Advisory
Changed	Reference Type	https://www.openssl.org/news/secadv/20210325.txt No Types Assigned	https://www.openssl.org/news/secadv/20210325.txt Vendor Advisory
Added	CWE		NIST CWE-295
Added	CPE Configuration		OR cpe:2.3:a:openssl:openssl::::::::* versions from (including) 1.1.1h up to (excluding) 1.1.1k
Added	CPE Configuration		OR cpe:2.3:o:freebsd:freebsd:12.2:-::::::* cpe:2.3:o:freebsd:freebsd:12.2:p1::::::* cpe:2.3:o:freebsd:freebsd:12.2:p2::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:netapp:santricity_smi-s_provider_firmware:-::::::: OR cpe:2.3:h:netapp:santricity_smi-s_provider:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:o:netapp:storagegrid_firmware:-::::::: OR cpe:2.3:h:netapp:storagegrid:-:::::::*
Added	CPE Configuration		OR cpe:2.3:o:windriver:linux:-::::cd:::* cpe:2.3:o:windriver:linux:17.0::::lts:::* cpe:2.3:o:windriver:linux:18.0::::lts:::* cpe:2.3:o:windriver:linux:19.0::::lts:::*

CVE-2021-3450

Apache OpenSSL Elliptic Curve Parameter Validation Bypass

Description

INFO

March 25, 2021, 3:15 p.m.

Nov. 7, 2023, 3:38 a.m.

Yes !

5.2

2.2

Public PoC/Exploit Available at Github

Affected Products

References to Advisories, Solutions, and Tools

CVE Modified by [email protected]

CVE Modified by [email protected]

Reanalysis by [email protected]

Modified Analysis by [email protected]

CVE Modified by [email protected]

Modified Analysis by [email protected]

CVE Modified by [email protected]

CVE Modified by [email protected]

CVE Modified by [email protected]

CVE Modified by [email protected]

CVE Modified by [email protected]

CVE Modified by [email protected]

Modified Analysis by [email protected]

CVE Modified by [email protected]

CVE Modified by [email protected]

CVE Modified by [email protected]

CVE Modified by [email protected]

Modified Analysis by [email protected]

CVE Modified by [email protected]

CVE Modified by [email protected]

CVE Modified by [email protected]

Initial Analysis by [email protected]

CVE Modified by [email protected]

CVE Modified by [email protected]

CVE Modified by [email protected]

CVE Modified by [email protected]

CVE Modified by [email protected]

CVE Modified by [email protected]

CVE Modified by [email protected]

CVE Modified by [email protected]

CWE - Common Weakness Enumeration

Common Attack Pattern Enumeration and Classification (CAPEC)

Exploit Prediction

0.23 }} -0.03%

0.61146

CVSS31 - Vulnerability Scoring System

Theme Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable