An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).
Fix
Public exploits 1
- riptl/cve-2021-3449 PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 10
- https://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf Patch, Third Party Advisory
- https://www.openssl.org/news/secadv/20210325.txt Vendor Advisory
- https://www.oracle.com//security-alerts/cpujul2021.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf Patch, Third Party Advisory
- https://www.openssl.org/news/secadv/20210325.txt Vendor Advisory
- https://www.oracle.com//security-alerts/cpujul2021.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.9 · openssl, debian, freebsdNVD modified 2026-10-08 22:17
Affected (CPE criteria) 136
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:12.2:-:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:12.2:p1:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:12.2:p2:*:*:*:*:*:*cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*cpe:2.3:a:netapp:cloud_volumes_ontap_mediator:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:*cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*cpe:2.3:a:tenable:nessus_network_monitor:5.11.0:*:*:*:*:*:*:*cpe:2.3:a:tenable:nessus_network_monitor:5.11.1:*:*:*:*:*:*:*cpe:2.3:a:tenable:nessus_network_monitor:5.12.0:*:*:*:*:*:*:*cpe:2.3:a:tenable:nessus_network_monitor:5.12.1:*:*:*:*:*:*:*cpe:2.3:a:tenable:nessus_network_monitor:5.13.0:*:*:*:*:*:*:*cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*cpe:2.3:a:mcafee:web_gateway:8.2.19:*:*:*:*:*:*:*cpe:2.3:a:mcafee:web_gateway:9.2.10:*:*:*:*:*:*:*cpe:2.3:a:mcafee:web_gateway:10.1.1:*:*:*:*:*:*:*cpe:2.3:a:mcafee:web_gateway_cloud_service:8.2.19:*:*:*:*:*:*:*cpe:2.3:a:mcafee:web_gateway_cloud_service:9.2.10:*:*:*:*:*:*:*cpe:2.3:a:mcafee:web_gateway_cloud_service:10.1.1:*:*:*:*:*:*:*cpe:2.3:o:checkpoint:quantum_security_management_firmware:r80.40:*:*:*:*:*:*:*cpe:2.3:o:checkpoint:quantum_security_management_firmware:r81:*:*:*:*:*:*:*cpe:2.3:o:checkpoint:multi-domain_management_firmware:r80.40:*:*:*:*:*:*:*cpe:2.3:o:checkpoint:multi-domain_management_firmware:r81:*:*:*:*:*:*:*cpe:2.3:o:checkpoint:quantum_security_gateway_firmware:r80.40:*:*:*:*:*:*:*cpe:2.3:o:checkpoint:quantum_security_gateway_firmware:r81:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_communications_policy_management:12.6.0.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.4.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:essbase:21.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:graalvm:19.3.5:*:*:*:enterprise:*:*:*- and 96 more
References 58
- http://www.openwall.com/lists/oss-security/2021/03/27/1 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/03/27/2 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/03/28/3 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/03/28/4 Mailing List, Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf Patch, Third Party Advisory
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fb9fa6b51defd48157eeb207f52181f735d96148
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845 Third Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10356 Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/08/msg00029.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013 Third Party Advisory
- https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc Third Party Advisory
- https://security.gentoo.org/glsa/202103-03 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210326-0006/ Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210513-0002/ Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd Third Party Advisory
- https://www.debian.org/security/2021/dsa-4875 Third Party Advisory
- https://www.openssl.org/news/secadv/20210325.txt Vendor Advisory
- https://www.oracle.com//security-alerts/cpujul2021.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html Third Party Advisory
- https://www.tenable.com/security/tns-2021-05 Third Party Advisory
- https://www.tenable.com/security/tns-2021-06 Third Party Advisory
- https://www.tenable.com/security/tns-2021-09 Third Party Advisory
- https://www.tenable.com/security/tns-2021-10 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/03/27/1 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/03/27/2 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/03/28/3 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/03/28/4 Mailing List, Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf Patch, Third Party Advisory
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fb9fa6b51defd48157eeb207f52181f735d96148
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845 Third Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10356 Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/08/msg00029.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013 Third Party Advisory
- https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc Third Party Advisory
- https://security.gentoo.org/glsa/202103-03 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210326-0006/ Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210513-0002/ Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd Third Party Advisory
- https://www.debian.org/security/2021/dsa-4875 Third Party Advisory
- https://www.openssl.org/news/secadv/20210325.txt Vendor Advisory
- https://www.oracle.com//security-alerts/cpujul2021.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html Third Party Advisory
- https://www.tenable.com/security/tns-2021-05 Third Party Advisory
- https://www.tenable.com/security/tns-2021-06 Third Party Advisory
- https://www.tenable.com/security/tns-2021-09 Third Party Advisory
- https://www.tenable.com/security/tns-2021-10 Third Party Advisory