high
7.5
CWE
835
Advisory Published
Advisory Published
Updated

CVE-2021-4044: Invalid handling of X509_verify_cert() internal errors in libssl

First published: Tue Dec 14 2021(Updated: )

Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error (for example out of memory). Such a negative return value is mishandled by OpenSSL and will cause an IO function (such as SSL_connect() or SSL_do_handshake()) to not indicate success and a subsequent call to SSL_get_error() to return the value SSL_ERROR_WANT_RETRY_VERIFY. This return value is only supposed to be returned by OpenSSL if the application has previously called SSL_CTX_set_cert_verify_callback(). Since most applications do not do this the SSL_ERROR_WANT_RETRY_VERIFY return value from SSL_get_error() will be totally unexpected and applications may not behave correctly as a result. The exact behaviour will depend on the application but it could result in crashes, infinite loops or other similar incorrect responses. This issue is made more serious in combination with a separate bug in OpenSSL 3.0 that will cause X509_verify_cert() to indicate an internal error when processing a certificate chain. This will occur where a certificate does not include the Subject Alternative Name extension but where a Certificate Authority has enforced name constraints. This issue can occur even with valid chains. By combining the two issues an attacker could induce incorrect, application dependent behaviour. Fixed in OpenSSL 3.0.1 (Affected 3.0.0).

Credit: openssl-security@openssl.org openssl-security@openssl.org openssl-security@openssl.org

Affected SoftwareAffected VersionHow to fix
rust/openssl-src>=300.0.0<300.0.4
300.0.4
OpenSSL OpenSSL<1.0.2
OpenSSL OpenSSL=1.1.0
OpenSSL OpenSSL=3.0.0
Netapp Cloud Backup
Netapp E-series Performance Analyzer
NetApp ONTAP Select Deploy administration utility
Netapp Snapcenter
Netapp A250
Netapp A250 Firmware
Netapp 500f
Netapp 500f Firmware
Netapp H500s
Netapp H500s Firmware
Netapp H700s
Netapp H700s Firmware
Netapp H300e
Netapp H300e Firmware
Netapp H500e
Netapp H500e Firmware
Netapp H700e
Netapp H700e Firmware
Netapp H410s Firmware
Netapp H410s
Netapp H410c Firmware
Netapp H410c
Netapp H300s Firmware
Netapp H300s
Nodejs Node.js>=17.0.0<17.3.0
Netapp Baseboard Management Controller A250 Firmware
Netapp Baseboard Management Controller A250
Netapp Baseboard Management Controller 500f Firmware
Netapp Baseboard Management Controller 500f

Remedy

https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=758754966791c537ea95241438454aa86f91f256

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the vulnerability ID of this issue?

    The vulnerability ID is CVE-2021-4044.

  • What is the severity of CVE-2021-4044?

    The severity of CVE-2021-4044 is high, with a severity value of 7.5.

  • Which software versions are affected by CVE-2021-4044?

    OpenSSL versions 1.0.2, 1.1.0, and 3.0.0, as well as Netapp Cloud Backup, Netapp E-series Performance Analyzer, NetApp ONTAP Select Deploy administration utility, and Netapp Snapcenter are affected by CVE-2021-4044.

  • How can CVE-2021-4044 be fixed?

    To fix CVE-2021-4044, it is recommended to update to a non-vulnerable version of OpenSSL or the affected software.

  • Where can I find more information about CVE-2021-4044?

    More information about CVE-2021-4044 can be found in the references provided: <ul><li><a href='https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=758754966791c537ea95241438454aa86f91f256'>OpenSSL Commit</a></li><li><a href='https://security.netapp.com/advisory/ntap-20211229-0003/'>Netapp Advisory</a></li><li><a href='https://www.openssl.org/news/secadv/20211214.txt'>OpenSSL Security Advisory</a></li></ul>

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203