Skip to content
Fencer Intel
medium 5.9

CVE-2021-3449 json

NULL pointer deref in signature_algorithms processing

published 5y ago modified 24d ago also BIT-node-2021-3449 , BIT-node-min-2021-3449 , EUVD-2021-1628 , GHSA-83mx-573x-5rw9 , JLSEC-2026-223 , RUSTSEC-2021-0055

cvss
5.9
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
63.5%
EPSS 63.5% chance of exploitation in 30 days, percentile 99.2%
public exploits
0
none known

Summary

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).

Patch / fix

  • crates.io openssl-src 111.15.0
  • bitnami node 10.12.1, 10.24.1, 12.12.1, 12.22.1, 14.14.1, 14.16.1, 15.14.0
  • bitnami node-min 10.12.1, 10.24.1, 12.12.1, 12.22.1, 14.14.1, 14.16.1, 15.14.0
  • julia OpenSSL_jll 1.1.10+0
  • openssl openssl 1.1.1k
  • tenable log_correlation_engine 6.0.9
  • oracle jd_edwards_enterpriseone_tools 9.2.6.0
  • oracle secure_backup 18.1.0.1.0
  • siemens sinec_infrastructure_network_services 1.0.1.1
  • nodejs node.js 12.22.1, 14.16.1, 15.14.0
  • sonicwall sma100_firmware 10.2.1.0-17sv
  • siemens scalance_xb-200_firmware 4.3
  • siemens scalance_xc-200_firmware 4.3
  • siemens scalance_xf-200ba_firmware 4.3
  • siemens scalance_xm-400_firmware 6.4
  • siemens scalance_xp-200_firmware 4.3
  • siemens scalance_xr-300wg_firmware 4.3
  • siemens scalance_xr524-8c_firmware 6.4
  • siemens scalance_xr526-8c_firmware 6.4
  • siemens scalance_xr528-6m_firmware 6.4
  • siemens scalance_xr552-12_firmware 6.4
  • siemens simatic_net_cp_1543-1_firmware 3.0
  • siemens tim_1531_irc_firmware 2.2
  • openssl Debian 14, Debian 13, Debian 12 1.1.1k-1

debian advisories DEBIAN-CVE-2021-3449

  • openssl Ubuntu 18.04 LTS 1.1.1-1ubuntu2.1~18.04.9
  • openssl Ubuntu 20.04 LTS 1.1.1f-1ubuntu2.3
  • postgresql-10 Ubuntu 18.04 LTS 10.18-0ubuntu0.18.04.1
  • postgresql-12 Ubuntu 20.04 LTS 12.8-0ubuntu0.20.04.1
  • openssl Ubuntu Pro FIPS-updates 18.04 LTS 1.1.1-1ubuntu2.fips.2.1~18.04.9.1
  • openssl Ubuntu Pro FIPS-updates 20.04 LTS 1.1.1f-1ubuntu2.fips.7
  • openssl Ubuntu Pro FIPS 20.04 LTS 1.1.1f-1ubuntu2.fips.2.8

ubuntu advisories UBUNTU-CVE-2021-3449

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • tomcat-native jboss enterprise web server 3.1 1.2.23-24.redhat_24.ep7.el7
  • jbcs-httpd24-httpd jboss core services 1 2.4.37-70.jbcs.el7
  • jbcs-httpd24-mod_jk jboss core services 1 1.2.48-13.redhat_1.jbcs.el7
  • jbcs-httpd24-mod_md jboss core services 1 1:2.0.8-33.jbcs.el7
  • jbcs-httpd24-mod_ssl jboss core services 1 1:2.4.37-70.jbcs.el7
  • jbcs-httpd24-nghttp2 jboss core services 1 1.39.2-37.jbcs.el7
  • jbcs-httpd24-openssl jboss core services 1 1:1.1.1g-6.jbcs.el7
  • jbcs-httpd24-mod_ldap jboss core services 1 2.4.37-70.jbcs.el7

red hat advisories RHSA-2021:1202RHSA-2021:1199RHSA-2021:1195RHSA-2021:1189RHSA-2021:1063RHSA-2021:1024

  • openssl-1_1 SLE Module for Certifications 15 SP3, SLE Module for Basesystem 15 SP2, SLE Micro 5.0 1.1.1d-11.20.1
  • nodejs10 SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +11 more 10.24.1-1.36.1
  • nodejs12 SLE Module for Web and Scripting 15 SP3, SLE Module for Web and Scripting 15 SP2 12.22.2-4.16.1
  • nodejs12 SLE Module for Web and Scripting 12 12.22.2-1.32.1
  • nodejs10 SLE Module for Web and Scripting 12 10.24.1-1.39.1
  • openssl-1_1 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +4 more 1.1.1d-2.33.1

suse advisories SUSE-SU-2021:0955-2SUSE-SU-2021:2353-1SUSE-SU-2021:2327-1SUSE-SU-2021:2326-1SUSE-SU-2021:2323-1SUSE-SU-2021:0955-1

  • matrix-synapse openSUSE Tumbleweed 1.43.0-1.1
  • openssl-1_1 openSUSE Tumbleweed 1.1.1l-1.2
  • nodejs10 openSUSE Leap 15.2 10.24.1-lp152.2.15.1
  • nodejs12 openSUSE Leap 15.2 12.22.2-lp152.3.15.1
  • nodejs10 openSUSE Leap 15.3 10.24.1-1.36.1
  • nodejs12 openSUSE Leap 15.3 12.22.2-4.16.1
  • openssl-1_1 openSUSE Leap 15.2 1.1.1d-lp152.7.15.1

opensuse advisories openSUSE-SU-2024:11041-1openSUSE-SU-2024:11127-1openSUSE-SU-2021:1061-1openSUSE-SU-2021:1059-1openSUSE-SU-2021:2353-1openSUSE-SU-2021:2327-1

  • openssl Rocky Linux 8 1:1.1.1g-15.el8_3

rocky linux advisories RLSA-2021:1024

  • openssl Alpine 3.24, Alpine 3.23, Alpine 3.22 +13 more 1.1.1k-r0
  • synapse Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 1.30.1-r0
  • openssl3 Alpine 3.16, Alpine 3.15 1.1.1k-r0
  • openssl1.1-compat Alpine 3.18, Alpine 3.17 1.1.1k-r0

alpine advisories ALPINE-CVE-2021-3449

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openssl Arch Linux 1.1.1.k-1

arch linux advisories AVG-1736

Is CVE-2021-3449 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-3449 updated cvss 5.9

openssl: NULL pointer dereference in signature_algorithms processing

  • Red Hat JBCS 2.4.37 SP7
    fixed: vendor fix RHSA-2021:1200
  • Red Hat Enterprise Linux BaseOS (v. 8) openssl 1.1.1g-15.el8_3, openssl-libs 1.1.1g-15.el8_3, openssl-perl 1.1.1g-15.el8_3
    fixed: vendor fix RHSA-2021:1024
  • Red Hat Enterprise Linux BaseOS EUS (v. 8.1) openssl 1.1.1c-5.el8_1, openssl-libs 1.1.1c-5.el8_1, openssl-perl 1.1.1c-5.el8_1
    fixed: vendor fix RHSA-2021:1131
  • Red Hat Enterprise Linux BaseOS EUS (v. 8.2) openssl 1.1.1c-18.el8_2, openssl-libs 1.1.1c-18.el8_2, openssl-perl 1.1.1c-18.el8_2
    fixed: vendor fix RHSA-2021:1063
  • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-httpd 2.4.37-70.jbcs.el7, jbcs-httpd24-mod_md 2.0.8-33.jbcs.el7, jbcs-httpd24-openssl 1.1.1g-6.jbcs.el7, jbcs-httpd24-mod_ssl 2.4.37-70.jbcs.el7, jbcs-httpd24-nghttp2 1.39.2-37.jbcs.el7, jbcs-httpd24-mod_ldap 2.4.37-70.jbcs.el7, +15 more
    fixed: vendor fix RHSA-2021:1199
  • Red Hat JBoss Web Server 3.1
    fixed: vendor fix RHSA-2021:1203
  • Red Hat JBoss Web Server 3.1 for RHEL 7 tomcat-native 1.2.23-24.redhat_24.ep7.el7
    fixed: vendor fix RHSA-2021:1202
  • Red Hat JBoss Web Server 5
    fixed: vendor fix RHSA-2021:1196
show 3 more
  • Red Hat JBoss Web Server 5.4 for RHEL 7 Server jws5-tomcat-native 1.2.25-4.redhat_4.el7jws Red Hat JBoss Web Server 5.4 for RHEL 8 jws5-tomcat-native 1.2.25-4.redhat_4.el8jws
    fixed: vendor fix RHSA-2021:1195
  • Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host 4.4.5-20210330.0.el8_3, redhat-virtualization-host-image-update 4.4.5-20210330.0.el8_3
    fixed: vendor fix RHSA-2021:1189
  • Red Hat Enterprise Linux 6 openssl, openssl098e, openssl-perl Red Hat Enterprise Linux 7 openssl, openssl098e, openssl-libs, openssl-perl Red Hat Enterprise Linux 8 compat-openssl10 Red Hat Enterprise Linux 9 openssl, openssl-libs, openssl-perl Red Hat Virtualization 4 Hypervisor for RHEL 8 zip 3.0-23.el8, isl 0.16.1-6.el8, tbb 2018.2-9.el8, cpp 8.3.1-5.1.el8, gcc 8.3.1-5.1.el8, make 4.2.1-10.el8, +16 more Red Hat RHEL 8-based RHEV-H for RHEV 4 (build requirements) imgbased 1.2.18-0.1.el8ev, python3-imgbased 1.2.18-0.1.el8ev, scap-security-guide 0.1.50-1.el8ev, scap-security-guide-rhv 0.1.50-1.el8ev, redhat-release-virtualization-host 4.4.5-4.el8ev, redhat-virtualization-host-image-update-placeholder 4.4.5-4.el8ev
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-22-104-05 updated cvss 5.9

Siemens OpenSSL Vulnerabilities in Industrial Products

  • Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC) >=V5.2.0, <V5.3_only_when_running_on_ROX_II_V2.14.0
    affected: fixed in V5.3, mitigation support.industry.siemens.com
  • Siemens RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) >=V6.2<V7.1 Siemens RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) >=V6.2<V7.1
    affected: fixed in V7.1, mitigation support.industry.siemens.com
  • Siemens SCALANCE LPE9403 (6GK5998-3GS00-2AC2) <V1.1
    affected: fixed in V1.1 support.industry.siemens.com
  • Siemens SCALANCE M804PB (6GK5804-0AP00-2AA2) >=V6.2<V7.1 Siemens SCALANCE M812-1 ADSL-Router (Annex A) (6GK5812-1AA00-2AA2) >=V6.2<V7.1 Siemens SCALANCE M812-1 ADSL-Router (Annex B) (6GK5812-1BA00-2AA2) >=V6.2<V7.1 Siemens SCALANCE M816-1 ADSL-Router (Annex A) (6GK5816-1AA00-2AA2) >=V6.2<V7.1 Siemens SCALANCE M816-1 ADSL-Router (Annex B) (6GK5816-1BA00-2AA2) >=V6.2<V7.1 Siemens SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) >=V6.2<V7.1
    +6 more products
    Siemens SCALANCE M874-2 (6GK5874-2AA00-2AA2) >=V6.2<V7.1 Siemens SCALANCE M874-3 (6GK5874-3AA00-2AA2) >=V6.2<V7.1 Siemens SCALANCE M876-3 (EVDO) (6GK5876-3AA02-2BA2) >=V6.2<V7.1 Siemens SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) >=V6.2<V7.1 Siemens SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) >=V6.2<V7.1 Siemens SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) >=V6.2<V7.1
    affected: fixed in V7.1, mitigation support.industry.siemens.com
  • Siemens SCALANCE S602 >=V4.1 Siemens SCALANCE S612 >=V4.1
    affected: no fix planned
  • Siemens SCALANCE S615 (6GK5615-0AA00-2AA2) >=V6.2<V7.1
    affected: fixed in V7.1, mitigation support.industry.siemens.com
  • Siemens SCALANCE S623 >=V4.1 Siemens SCALANCE S627-2M >=V4.1
    affected: no fix planned
  • Siemens SCALANCE SC622-2C (6GK5622-2GS00-2AC2) >=V2.0<V2.1.4 Siemens SCALANCE SC632-2C (6GK5632-2GS00-2AC2) >=V2.0<V2.1.4 Siemens SCALANCE SC636-2C (6GK5636-2GS00-2AC2) >=V2.0<V2.1.4 Siemens SCALANCE SC642-2C (6GK5642-2GS00-2AC2) >=V2.0<V2.1.4 Siemens SCALANCE SC646-2C (6GK5646-2GS00-2AC2) >=V2.0<V2.1.4
    affected: fixed in V2.1.4 support.industry.siemens.com
show 6 more
  • Siemens SCALANCE W-700 IEEE 802.11n family >=V6.5
    affected: no fix planned
  • Siemens SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0) >=V2.0<V3.0 Siemens SCALANCE W1748-1 M12 (6GK5748-1GY01-0TA0) >=V2.0<V3.0 Siemens SCALANCE W1788-1 M12 (6GK5788-1GY01-0AA0) >=V2.0<V3.0 Siemens SCALANCE W1788-2 EEC M12 (6GK5788-2GY01-0TA0) >=V2.0<V3.0 Siemens SCALANCE W1788-2 M12 (6GK5788-2GY01-0AA0) >=V2.0<V3.0 Siemens SCALANCE W1788-2IA M12 (6GK5788-2HY01-0AA0) >=V2.0<V3.0
    affected: fixed in V3.0 support.industry.siemens.com
  • Siemens SCALANCE XB-200 <V4.3 Siemens SCALANCE XC-200 <V4.3 Siemens SCALANCE XF-200BA <V4.3
    affected: fixed in V4.3 support.industry.siemens.com
  • Siemens SCALANCE XM-400 <V6.4
    affected: fixed in V6.4 support.industry.siemens.com
  • Siemens SCALANCE XP-200 <V4.3 Siemens SCALANCE XR-300WG <V4.3
    affected: fixed in V4.3 support.industry.siemens.com
  • Siemens SCALANCE XR-500 Family <V6.4
    affected: fixed in V6.4 support.industry.siemens.com

55 more affected in the full advisory

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-21-336-06 updated cvss 5.9

Hitachi Energy APM Edge

  • Hitachi Energy APM Edge 3.0, 2.0, 1.0
    affected: vendor fix, mitigation “Physically protect process control systems from direct access by unauthorized personnel.” search.abb.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
last mo.

Exploit prediction

63.54% chance of exploitation in the next 30 days, higher than 99.2% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
GitHub 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P
OSV 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
crates.io openssl-src
<111.15.0
>=0.0.0-0, <111.15.0
111.15.0
bitnami node
>=10.0.0, <10.12.1
>=10.13.0, <10.24.1
>=12.0.0, <12.12.1
>=12.13.0, <12.22.1
>=14.0.0, <14.14.1
>=14.15.0, <14.16.1
>=15.0.0, <15.14.0
10.12.1
10.24.1
12.12.1
12.22.1
14.14.1
14.16.1
15.14.0
bitnami node-min
>=10.0.0, <10.12.1
>=10.13.0, <10.24.1
>=12.0.0, <12.12.1
>=12.13.0, <12.22.1
>=14.0.0, <14.14.1
>=14.15.0, <14.16.1
>=15.0.0, <15.14.0
10.12.1
10.24.1
12.12.1
12.22.1
14.14.1
14.16.1
15.14.0
julia OpenSSL_jll
<1.1.10+0
1.1.10+0

Affected products

  • OpenSSL OpenSSL

Classification

Weakness
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.