CVE-2021-3449 : An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation Clie

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).

Published 2021-03-25 15:15:13

Updated 2024-06-21 19:15:20

Source OpenSSL Software Foundation

View at NVD, CVE.org

Vulnerability category: Memory CorruptionDenial of service

Products affected by CVE-2021-3449

Freebsd » Freebsd » Version: 12.2
cpe:2.3:o:freebsd:freebsd:12.2:-:*:*:*:*:*:*
Matching versions
Freebsd » Freebsd » Version: 12.2 Update P1
cpe:2.3:o:freebsd:freebsd:12.2:p1:*:*:*:*:*:*
Matching versions
Freebsd » Freebsd » Version: 12.2 Update P2
cpe:2.3:o:freebsd:freebsd:12.2:p2:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Matching versions
Oracle » Peoplesoft Enterprise Peopletools » Version: 8.57
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*
Matching versions
Oracle » Peoplesoft Enterprise Peopletools » Version: 8.58
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
Matching versions
Oracle » Peoplesoft Enterprise Peopletools » Version: 8.59
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
Matching versions
Oracle » Secure Backup
Versions before (<) 18.1.0.1.0
cpe:2.3:a:oracle:secure_backup:*:*:*:*:*:*:*:*
Matching versions
Oracle » Jd Edwards Enterpriseone Tools
Versions before (<) 9.2.6.0
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Matching versions
Oracle » Secure Global Desktop » Version: 5.6
cpe:2.3:a:oracle:secure_global_desktop:5.6:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql Connectors
Versions up to, including, (<=) 8.0.23
cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:*
Matching versions
Oracle » Primavera Unifier
Versions from including (>=) 17.7 and up to, including, (<=) 17.12
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*
Matching versions
Oracle » Primavera Unifier » Version: 19.12
cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*
Matching versions
Oracle » Primavera Unifier » Version: 20.12
cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*
Matching versions
Oracle » Primavera Unifier » Version: 21.12
cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql Workbench
Versions up to, including, (<=) 8.0.23
cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*
Matching versions
Oracle » Jd Edwards World Security » Version: A9.4
cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:*
Matching versions
Oracle » Graalvm » Version: 19.3.5 Enterprise Edition
cpe:2.3:a:oracle:graalvm:19.3.5:*:*:*:enterprise:*:*:*
Matching versions
Oracle » Graalvm » Version: 20.3.1.2 Enterprise Edition
cpe:2.3:a:oracle:graalvm:20.3.1.2:*:*:*:enterprise:*:*:*
Matching versions
Oracle » Graalvm » Version: 21.0.0.2 Enterprise Edition
cpe:2.3:a:oracle:graalvm:21.0.0.2:*:*:*:enterprise:*:*:*
Matching versions
Oracle » Communications Communications Policy Management » Version: 12.6.0.0.0
cpe:2.3:a:oracle:communications_communications_policy_management:12.6.0.0.0:*:*:*:*:*:*:*
Matching versions
Oracle » Zfs Storage Appliance Kit » Version: 8.8
cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql Server
Versions from including (>=) 8.0.15 and up to, including, (<=) 8.0.23
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql Server
Versions up to, including, (<=) 5.7.33
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Matching versions
Oracle » Enterprise Manager For Storage Management » Version: 13.4.0.0
cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.4.0.0:*:*:*:*:*:*:*
Matching versions
Oracle » Essbase » Version: 21.2
cpe:2.3:a:oracle:essbase:21.2:*:*:*:*:*:*:*
Matching versions
Siemens » Sinema Server » Version: 14.0
cpe:2.3:a:siemens:sinema_server:14.0:-:*:*:*:*:*:*
Matching versions
Siemens » Sinema Server » Version: 14.0 Update SP1
cpe:2.3:a:siemens:sinema_server:14.0:sp1:*:*:*:*:*:*
Matching versions
Siemens » Sinema Server » Version: 14.0 Update SP2
cpe:2.3:a:siemens:sinema_server:14.0:sp2:*:*:*:*:*:*
Matching versions
Siemens » Sinema Server » Version: 14.0 Update Sp2 Update1
cpe:2.3:a:siemens:sinema_server:14.0:sp2_update1:*:*:*:*:*:*
Matching versions
Siemens » Sinema Server » Version: 14.0 Update Sp2 Update2
cpe:2.3:a:siemens:sinema_server:14.0:sp2_update2:*:*:*:*:*:*
Matching versions
Siemens » Scalance M-800 Firmware
Versions from including (>=) 6.2
cpe:2.3:o:siemens:scalance_m-800_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance M-800 » Version: N/A
Siemens » Scalance S615 Firmware
Versions from including (>=) 6.2
cpe:2.3:o:siemens:scalance_s615_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance S615 » Version: N/A
Siemens » Simatic Logon
Versions from including (>=) 1.6.0.2
cpe:2.3:a:siemens:simatic_logon:*:*:*:*:*:*:*:*
Matching versions
Siemens » Simatic Logon » Version: 1.5 Update Sp3 Update 1
cpe:2.3:a:siemens:simatic_logon:1.5:sp3_update_1:*:*:*:*:*:*
Matching versions
Siemens » Scalance W700 Firmware
Versions from including (>=) 6.5
cpe:2.3:o:siemens:scalance_w700_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance W700 » Version: N/A
Siemens » Simatic Rf188c Firmware
cpe:2.3:o:siemens:simatic_rf188c_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Rf188c » Version: N/A
Siemens » Simatic Wincc Runtime Advanced
cpe:2.3:a:siemens:simatic_wincc_runtime_advanced:*:*:*:*:*:*:*:*
Matching versions
Siemens » Simatic Rf185c Firmware
cpe:2.3:o:siemens:simatic_rf185c_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Rf185c » Version: N/A
Siemens » Simatic Hmi Comfort Outdoor Panels Firmware
cpe:2.3:o:siemens:simatic_hmi_comfort_outdoor_panels_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Hmi Comfort Outdoor Panels » Version: N/A
Siemens » Simatic Rf186c Firmware
cpe:2.3:o:siemens:simatic_rf186c_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Rf186c » Version: N/A
Siemens » Tim 1531 Irc Firmware
Versions from including (>=) 2.0 and before (<) 2.2
cpe:2.3:o:siemens:tim_1531_irc_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Tim 1531 Irc » Version: N/A
Siemens » Tia Administrator
cpe:2.3:a:siemens:tia_administrator:*:*:*:*:*:*:*:*
Matching versions
Siemens » Scalance Xb-200 Firmware
Versions before (<) 4.3
cpe:2.3:o:siemens:scalance_xb-200_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance Xb-200 » Version: N/A
Siemens » Scalance Xc-200 Firmware
Versions before (<) 4.3
cpe:2.3:o:siemens:scalance_xc-200_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance Xc-200 » Version: N/A
Siemens » Scalance Xf-200ba Firmware
Versions before (<) 4.3
cpe:2.3:o:siemens:scalance_xf-200ba_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance Xf-200ba » Version: N/A
Siemens » Scalance Xp-200 Firmware
Versions before (<) 4.3
cpe:2.3:o:siemens:scalance_xp-200_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance Xp-200 » Version: N/A
Siemens » Scalance Xr-300wg Firmware
Versions before (<) 4.3
cpe:2.3:o:siemens:scalance_xr-300wg_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance Xr-300wg » Version: N/A
Siemens » Scalance Sc-600 Firmware
Versions from including (>=) 2.0
cpe:2.3:o:siemens:scalance_sc-600_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance Sc-600 » Version: N/A
Siemens » Simatic S7-1200 Cpu 1211c Firmware
cpe:2.3:o:siemens:simatic_s7-1200_cpu_1211c_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic S7-1200 Cpu 1211c » Version: N/A
Siemens » Simatic S7-1200 Cpu 1212c Firmware
cpe:2.3:o:siemens:simatic_s7-1200_cpu_1212c_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic S7-1200 Cpu 1212c » Version: N/A
Siemens » Simatic S7-1200 Cpu 1214c Firmware
cpe:2.3:o:siemens:simatic_s7-1200_cpu_1214c_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic S7-1200 Cpu 1214c » Version: N/A
Siemens » Simatic S7-1200 Cpu 1215c Firmware
cpe:2.3:o:siemens:simatic_s7-1200_cpu_1215c_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic S7-1200 Cpu 1215c » Version: N/A
Siemens » Simatic S7-1200 Cpu 1217c Firmware
cpe:2.3:o:siemens:simatic_s7-1200_cpu_1217c_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic S7-1200 Cpu 1217c » Version: N/A
Siemens » Simatic Hmi Ktp Mobile Panels Firmware
cpe:2.3:o:siemens:simatic_hmi_ktp_mobile_panels_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Hmi Ktp Mobile Panels » Version: N/A
Siemens » Scalance Xm-400 Firmware
Versions before (<) 6.4
cpe:2.3:o:siemens:scalance_xm-400_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance Xm-400 » Version: N/A
Siemens » Scalance S602 Firmware
Versions from including (>=) 4.1
cpe:2.3:o:siemens:scalance_s602_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance S602 » Version: N/A
Siemens » Scalance S612 Firmware
Versions from including (>=) 4.1
cpe:2.3:o:siemens:scalance_s612_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance S612 » Version: N/A
Siemens » Scalance S623 Firmware
Versions from including (>=) 4.1
cpe:2.3:o:siemens:scalance_s623_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance S623 » Version: N/A
Siemens » Scalance S627-2m Firmware
Versions from including (>=) 4.1
cpe:2.3:o:siemens:scalance_s627-2m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance S627-2m » Version: N/A
Siemens » Sinumerik Opc Ua Server
cpe:2.3:a:siemens:sinumerik_opc_ua_server:*:*:*:*:*:*:*:*
Matching versions
Siemens » Simatic Hmi Basic Panels 2nd Generation Firmware
cpe:2.3:o:siemens:simatic_hmi_basic_panels_2nd_generation_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Hmi Basic Panels 2nd Generation » Version: N/A
Siemens » Simatic Rf166c Firmware
cpe:2.3:o:siemens:simatic_rf166c_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Rf166c » Version: N/A
Siemens » Simatic Rf186ci Firmware
cpe:2.3:o:siemens:simatic_rf186ci_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Rf186ci » Version: N/A
Siemens » Simatic Rf188ci Firmware
cpe:2.3:o:siemens:simatic_rf188ci_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Rf188ci » Version: N/A
Siemens » Simatic Rf360r Firmware
cpe:2.3:o:siemens:simatic_rf360r_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Rf360r » Version: N/A
Siemens » Scalance W1700 Firmware
Versions from including (>=) 2.0
cpe:2.3:o:siemens:scalance_w1700_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance W1700 » Version: N/A
Siemens » Simatic Mv500 Firmware
cpe:2.3:o:siemens:simatic_mv500_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Mv500 » Version: N/A
Siemens » Simatic Pdm Firmware
Versions from including (>=) 9.1.0.7
cpe:2.3:o:siemens:simatic_pdm_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Pdm » Version: N/A
Siemens » Simatic Net Cp 1545-1 Firmware
Versions from including (>=) 1.0
cpe:2.3:o:siemens:simatic_net_cp_1545-1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Net Cp 1545-1 » Version: N/A
Siemens » Simatic Net Cp 1543-1 Firmware
Versions from including (>=) 2.2 and before (<) 3.0
cpe:2.3:o:siemens:simatic_net_cp_1543-1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Net Cp 1543-1 » Version: N/A
Siemens » Ruggedcom Rcm1224 Firmware
Versions from including (>=) 6.2
cpe:2.3:o:siemens:ruggedcom_rcm1224_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Ruggedcom Rcm1224 » Version: N/A
Siemens » Scalance Lpe9403 Firmware
cpe:2.3:o:siemens:scalance_lpe9403_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance Lpe9403 » Version: N/A
Siemens » Scalance Xr524-8c Firmware
Versions before (<) 6.4
cpe:2.3:o:siemens:scalance_xr524-8c_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance Xr524-8c » Version: N/A
Siemens » Scalance Xr526-8c Firmware
Versions before (<) 6.4
cpe:2.3:o:siemens:scalance_xr526-8c_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance Xr526-8c » Version: N/A
Siemens » Scalance Xr528-6m Firmware
Versions before (<) 6.4
cpe:2.3:o:siemens:scalance_xr528-6m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance Xr528-6m » Version: N/A
Siemens » Scalance Xr552-12 Firmware
Versions before (<) 6.4
cpe:2.3:o:siemens:scalance_xr552-12_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance Xr552-12 » Version: N/A
Siemens » Simatic Cloud Connect 7 Firmware
Versions from including (>=) 1.1
cpe:2.3:o:siemens:simatic_cloud_connect_7_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Cloud Connect 7 » Version: N/A
Siemens » Simatic Cloud Connect 7 Firmware » Version: N/A
cpe:2.3:o:siemens:simatic_cloud_connect_7_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Cloud Connect 7 » Version: N/A
Siemens » Simatic Cp 1242-7 Gprs V2 Firmware
Versions from including (>=) 3.1
cpe:2.3:o:siemens:simatic_cp_1242-7_gprs_v2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Cp 1242-7 Gprs V2 » Version: N/A
Siemens » Simatic Cp 1242-7 Gprs V2 Firmware » Version: N/A
cpe:2.3:o:siemens:simatic_cp_1242-7_gprs_v2_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Cp 1242-7 Gprs V2 » Version: N/A
Siemens » Simatic Net Cp 1243-1 Firmware
Versions from including (>=) 3.1
cpe:2.3:o:siemens:simatic_net_cp_1243-1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Net Cp 1243-1 » Version: N/A
Siemens » Simatic Net Cp1243-7 Lte Eu Firmware
Versions from including (>=) 3.1
cpe:2.3:o:siemens:simatic_net_cp1243-7_lte_eu_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Net Cp1243-7 Lte Eu » Version: N/A
Siemens » Simatic Net Cp1243-7 Lte Us Firmware
Versions from including (>=) 3.1
cpe:2.3:o:siemens:simatic_net_cp1243-7_lte_us_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Net Cp1243-7 Lte Us » Version: N/A
Siemens » Simatic Net Cp 1243-8 Irc Firmware
Versions from including (>=) 3.1
cpe:2.3:o:siemens:simatic_net_cp_1243-8_irc_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Net Cp 1243-8 Irc » Version: N/A
Siemens » Simatic Net Cp 1542sp-1 Irc Firmware
Versions from including (>=) 2.1
cpe:2.3:o:siemens:simatic_net_cp_1542sp-1_irc_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Net Cp 1542sp-1 Irc » Version: N/A
Siemens » Simatic Net Cp 1543sp-1 Firmware
Versions from including (>=) 2.1
cpe:2.3:o:siemens:simatic_net_cp_1543sp-1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Net Cp 1543sp-1 » Version: N/A
Siemens » Simatic Pcs 7 Telecontrol Firmware
cpe:2.3:o:siemens:simatic_pcs_7_telecontrol_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Pcs 7 Telecontrol » Version: N/A
Siemens » Simatic Pcs Neo Firmware
cpe:2.3:o:siemens:simatic_pcs_neo_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Pcs Neo » Version: N/A
Siemens » Simatic Process Historian Opc Ua Server Firmware
Versions from including (>=) 2019
cpe:2.3:o:siemens:simatic_process_historian_opc_ua_server_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic Process Historian Opc Ua Server » Version: N/A
Siemens » Simatic S7-1200 Cpu 1212fc Firmware
cpe:2.3:o:siemens:simatic_s7-1200_cpu_1212fc_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic S7-1200 Cpu 1212fc » Version: N/A
Siemens » Simatic S7-1200 Cpu 1214 Fc Firmware
cpe:2.3:o:siemens:simatic_s7-1200_cpu_1214_fc_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic S7-1200 Cpu 1214 Fc » Version: N/A
Siemens » Simatic S7-1200 Cpu 1215 Fc Firmware
cpe:2.3:o:siemens:simatic_s7-1200_cpu_1215_fc_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic S7-1200 Cpu 1215 Fc » Version: N/A
Siemens » Simatic S7-1500 Cpu 1518-4 Pn/dp Mfp Firmware
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Simatic S7-1500 Cpu 1518-4 Pn/dp Mfp » Version: N/A
Siemens » Sinamics Connect 300 Firmware
cpe:2.3:o:siemens:sinamics_connect_300_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Sinamics Connect 300 » Version: N/A
Siemens » Simatic Wincc Telecontrol » Version: N/A
cpe:2.3:a:siemens:simatic_wincc_telecontrol:-:*:*:*:*:*:*:*
Matching versions
Siemens » Sinec Nms » Version: 1.0
cpe:2.3:a:siemens:sinec_nms:1.0:-:*:*:*:*:*:*
Matching versions
Siemens » Sinec Nms » Version: 1.0 Update SP1
cpe:2.3:a:siemens:sinec_nms:1.0:sp1:*:*:*:*:*:*
Matching versions
Siemens » Sinec Pni » Version: N/A
cpe:2.3:a:siemens:sinec_pni:-:*:*:*:*:*:*:*
Matching versions
Siemens » Sinec Infrastructure Network Services
Versions before (<) 1.0.1.1
cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*
Matching versions
Checkpoint » Quantum Security Management Firmware » Version: R80.40
cpe:2.3:o:checkpoint:quantum_security_management_firmware:r80.40:*:*:*:*:*:*:*
Matching versions
When used together with: Checkpoint » Quantum Security Management » Version: N/A
Checkpoint » Quantum Security Management Firmware » Version: R81
cpe:2.3:o:checkpoint:quantum_security_management_firmware:r81:*:*:*:*:*:*:*
Matching versions
When used together with: Checkpoint » Quantum Security Management » Version: N/A
Checkpoint » Multi-domain Management Firmware » Version: R80.40
cpe:2.3:o:checkpoint:multi-domain_management_firmware:r80.40:*:*:*:*:*:*:*
Matching versions
When used together with: Checkpoint » Multi-domain Management » Version: N/A
Checkpoint » Multi-domain Management Firmware » Version: R81
cpe:2.3:o:checkpoint:multi-domain_management_firmware:r81:*:*:*:*:*:*:*
Matching versions
When used together with: Checkpoint » Multi-domain Management » Version: N/A
Checkpoint » Quantum Security Gateway Firmware » Version: R80.40
cpe:2.3:o:checkpoint:quantum_security_gateway_firmware:r80.40:*:*:*:*:*:*:*
Matching versions
When used together with: Checkpoint » Quantum Security Gateway » Version: N/A
Checkpoint » Quantum Security Gateway Firmware » Version: R81
cpe:2.3:o:checkpoint:quantum_security_gateway_firmware:r81:*:*:*:*:*:*:*
Matching versions
When used together with: Checkpoint » Quantum Security Gateway » Version: N/A
Openssl » Openssl
Versions from including (>=) 1.1.1 and before (<) 1.1.1k
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
Matching versions
Mcafee » Web Gateway » Version: 8.2.19
cpe:2.3:a:mcafee:web_gateway:8.2.19:*:*:*:*:*:*:*
Matching versions
Mcafee » Web Gateway » Version: 9.2.10
cpe:2.3:a:mcafee:web_gateway:9.2.10:*:*:*:*:*:*:*
Matching versions
Mcafee » Web Gateway » Version: 10.1.1
cpe:2.3:a:mcafee:web_gateway:10.1.1:*:*:*:*:*:*:*
Matching versions
Mcafee » Web Gateway Cloud Service » Version: 8.2.19
cpe:2.3:a:mcafee:web_gateway_cloud_service:8.2.19:*:*:*:*:*:*:*
Matching versions
Mcafee » Web Gateway Cloud Service » Version: 9.2.10
cpe:2.3:a:mcafee:web_gateway_cloud_service:9.2.10:*:*:*:*:*:*:*
Matching versions
Mcafee » Web Gateway Cloud Service » Version: 10.1.1
cpe:2.3:a:mcafee:web_gateway_cloud_service:10.1.1:*:*:*:*:*:*:*
Matching versions
Sonicwall » Sonicos » Version: 7.0.1.0
cpe:2.3:o:sonicwall:sonicos:7.0.1.0:*:*:*:*:*:*:*
Matching versions
Sonicwall » Sma100 Firmware
Versions from including (>=) 10.2.0.0 and before (<) 10.2.1.0-17sv
cpe:2.3:o:sonicwall:sma100_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Sonicwall » Sma100 » Version: N/A
Sonicwall » Capture Client » Version: 3.5
cpe:2.3:a:sonicwall:capture_client:3.5:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 34
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
Matching versions
Netapp » Oncommand Workflow Automation » Version: N/A
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
Matching versions
Netapp » Oncommand Insight » Version: N/A
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
Matching versions
Netapp » Snapcenter » Version: N/A
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
Matching versions
Netapp » Ontap Select Deploy Administration Utility » Version: N/A
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
Matching versions
Netapp » Santricity Smi-s Provider » Version: N/A
cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:*
Matching versions
Netapp » Storagegrid » Version: N/A
cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*
Matching versions
Netapp » Active Iq Unified Manager » Version: N/A For Vmware Vsphere
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
Matching versions
Netapp » Cloud Volumes Ontap Mediator » Version: N/A
cpe:2.3:a:netapp:cloud_volumes_ontap_mediator:-:*:*:*:*:*:*:*
Matching versions
Netapp » E-series Performance Analyzer » Version: N/A
cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*
Matching versions
Nodejs » Node.js »
Versions from including (>=) 10.0.0 and up to, including, (<=) 10.12.0
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
Matching versions
Nodejs » Node.js » LTS Edition
Versions from including (>=) 14.15.0 and before (<) 14.16.1
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
Matching versions
Nodejs » Node.js » LTS Edition
Versions from including (>=) 12.13.0 and before (<) 12.22.1
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
Matching versions
Nodejs » Node.js »
Versions from including (>=) 15.0.0 and before (<) 15.14.0
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
Matching versions
Nodejs » Node.js »
Versions from including (>=) 14.0.0 and up to, including, (<=) 14.14.0
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
Matching versions
Nodejs » Node.js » LTS Edition
Versions from including (>=) 10.13.0 and up to, including, (<=) 10.24.0
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
Matching versions
Nodejs » Node.js »
Versions from including (>=) 12.0.0 and up to, including, (<=) 12.12.0
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
Matching versions
Tenable » Nessus
Versions up to, including, (<=) 8.13.1
cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*
Matching versions
Tenable » Log Correlation Engine
Versions before (<) 6.0.9
cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:*
Matching versions
Tenable » Tenable.sc
Versions from including (>=) 5.13.0 and up to, including, (<=) 5.17.0
cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*
Matching versions
Tenable » Nessus Network Monitor » Version: 5.11.0
cpe:2.3:a:tenable:nessus_network_monitor:5.11.0:*:*:*:*:*:*:*
Matching versions
Tenable » Nessus Network Monitor » Version: 5.11.1
cpe:2.3:a:tenable:nessus_network_monitor:5.11.1:*:*:*:*:*:*:*
Matching versions
Tenable » Nessus Network Monitor » Version: 5.12.0
cpe:2.3:a:tenable:nessus_network_monitor:5.12.0:*:*:*:*:*:*:*
Matching versions
Tenable » Nessus Network Monitor » Version: 5.12.1
cpe:2.3:a:tenable:nessus_network_monitor:5.12.1:*:*:*:*:*:*:*
Matching versions
Tenable » Nessus Network Monitor » Version: 5.13.0
cpe:2.3:a:tenable:nessus_network_monitor:5.13.0:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-3449

EPSS FAQ

13.86%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 94 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-3449

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:N/A:P	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
5.9	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H	2.2	3.6	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2021-3449

CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-3449

https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fb9fa6b51defd48157eeb207f52181f735d96148

git.openssl.org Git
https://lists.debian.org/debian-lts-announce/2021/08/msg00029.html

[SECURITY] [DLA 2751-1] postgresql-9.6 security update
Mailing List;Third Party Advisory
https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc

Third Party Advisory

CVEs referencing this url
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845

Pulse Security Advisory: SA44845 - OpenSSL Security Advisory CVE-2021-3450
Third Party Advisory

CVEs referencing this url
https://www.tenable.com/security/tns-2021-10

[R1] LCE 6.0.9 Fixes Multiple Third-party Vulnerabilities - Security Advisory | Tenable®
Third Party Advisory

CVEs referencing this url
https://www.tenable.com/security/tns-2021-06

[R1] Tenable.sc 5.18.0 Fixes One Third-party Vulnerability - Security Advisory | Tenable®
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html

Oracle Critical Patch Update Advisory - April 2022
Patch;Third Party Advisory

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2021/03/27/1

oss-security - OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing
Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/

[SECURITY] Fedora 34 Update: openssl-1.1.1k-1.fc34 - package-announce - Fedora Mailing-Lists
https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fb9fa6b51defd48157eeb207f52181f735d96148

git.openssl.org Git - openssl.git/commitdiff
Mailing List;Patch;Vendor Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013

Security Advisory
Third Party Advisory

CVEs referencing this url
https://security.netapp.com/advisory/ntap-20210326-0006/

March 2021 OpenSSL Vulnerabilities in NetApp Products | NetApp Product Security
Third Party Advisory

CVEs referencing this url
https://www.oracle.com//security-alerts/cpujul2021.html

Oracle Critical Patch Update Advisory - July 2021
Patch;Third Party Advisory

CVEs referencing this url
https://www.tenable.com/security/tns-2021-05

[R1] Nessus 8.13.2 Fixes Multiple Third-party Vulnerabilities - Security Advisory | Tenable®
Third Party Advisory

CVEs referencing this url
https://www.debian.org/security/2021/dsa-4875

Debian -- Security Information -- DSA-4875-1 openssl
Third Party Advisory
https://www.tenable.com/security/tns-2021-09

[R1] Nessus Network Monitor 5.13.1 Fixes Multiple Third-party Vulnerabilities - Security Advisory | Tenable®
Third Party Advisory

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2021/03/28/4

oss-security - Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing
Mailing List;Third Party Advisory

CVEs referencing this url
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd

Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2021
Third Party Advisory

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2021/03/27/2

oss-security - Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing
Mailing List;Third Party Advisory

CVEs referencing this url
https://www.oracle.com/security-alerts/cpuApr2021.html

Oracle Critical Patch Update Advisory - April 2021
Patch;Third Party Advisory

CVEs referencing this url
https://security.netapp.com/advisory/ntap-20210513-0002/

April 2021 MySQL Vulnerabilities in NetApp Products | NetApp Product Security
Third Party Advisory

CVEs referencing this url
https://security.netapp.com/advisory/ntap-20240621-0006/

February 2024 IBM Cognos Analytics Vulnerabilities in NetApp Products | NetApp Product Security

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/

[SECURITY] Fedora 34 Update: openssl-1.1.1k-1.fc34 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory

CVEs referencing this url
https://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf

Patch;Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html

Oracle Critical Patch Update Advisory - October 2021
Third Party Advisory

CVEs referencing this url
https://kc.mcafee.com/corporate/index?page=content&id=SB10356

McAfee Security Bulletin - Status and updates for OpenSSL vulnerabilities (CVE-2021-3450 and 2021-3449)
Third Party Advisory

CVEs referencing this url
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

Third Party Advisory

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2021/03/28/3

oss-security - Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing
Mailing List;Third Party Advisory

CVEs referencing this url
https://www.oracle.com/security-alerts/cpujul2022.html

Oracle Critical Patch Update Advisory - July 2022
Third Party Advisory

CVEs referencing this url
https://security.gentoo.org/glsa/202103-03

OpenSSL: Multiple vulnerabilities (GLSA 202103-03) — Gentoo security
Third Party Advisory

CVEs referencing this url
https://www.openssl.org/news/secadv/20210325.txt

Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2021-3449

Products affected by CVE-2021-3449

Exploit prediction scoring system (EPSS) score for CVE-2021-3449

CVSS scores for CVE-2021-3449

CWE ids for CVE-2021-3449

References for CVE-2021-3449