CVE-2021-3449 is a medium-severity vulnerability affecting OpenSSL TLS servers with TLSv1.2 and renegotiation enabled, which is the default configuration. This vulnerability can lead to a denial of service attack if a maliciously crafted renegotiation ClientHello message is sent to the server. Systems running vulnerable versions of OpenSSL, including a wide range of software configurations from various vendors, are affected. To mitigate this issue, users should upgrade to OpenSSL 1.1.1k.

How do I know if I'm affected?

If you're using OpenSSL, you might be affected by the vulnerability. This issue impacts all OpenSSL 1.1.1 versions from 1.1.1 to 1.1.1j. To check if you're affected, you need to determine if your system is running a vulnerable version of OpenSSL with TLSv1.2 and renegotiation enabled, which is the default configuration. Keep in mind that OpenSSL TLS clients are not affected by this vulnerability, only servers are at risk.

What should I do if I'm affected?

If you're affected by the vulnerability, upgrade to OpenSSL 1.1.1k to fix the issue. Follow these simple steps: 1) Identify your current OpenSSL version, 2) Check if it's between 1.1.1 and 1.1.1j, 3) If so, update to version 1.1.1k. This will protect your server from potential denial of service attacks.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

Yes, it is in CISA's Known Exploited Vulnerabilities Catalog. The vulnerability, named OpenSSL TLS server crash issue, and has a medium severity rating of 5.9. Although the specific date added and due date are not provided, the required action is to upgrade affected OpenSSL versions to 1.1.1k to mitigate the risk of a denial of service attack.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-476, which involves a NULL pointer dereference issue in OpenSSL, which can cause a server crash. This vulnerability is identified as and has a medium severity rating.

For more details

CVE-2021-3449 is a medium-severity vulnerability affecting OpenSSL TLS servers, which can lead to a denial of service attack. By upgrading to OpenSSL 1.1.1k, users can mitigate this risk. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• OpenSSL 1.1.1 CVE-2021-3450 and CVE-2021-3449 discussion

• Leak of vulnerability details by Wind River

• OpenSSL pre-notification process and concerns

• Response from Jeroen Roovers to Mark J Cox