OpenSSL up to 1.0.2x/1.1.1i RSA Signature inadequate encryption

Summaryinfo

A vulnerability described as problematic has been identified in OpenSSL up to 1.0.2x/1.1.1i. The affected element is an unknown function of the component RSA Signature Handler. Such manipulation leads to inadequate encryption. This vulnerability is referenced as CVE-2021-23839. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in OpenSSL up to 1.0.2x/1.1.1i (Network Encryption Software). It has been rated as problematic. Affected by this issue is an unknown code block of the component RSA Signature Handler. The manipulation with an unknown input leads to a inadequate encryption vulnerability. Using CWE to declare the problem leads to CWE-326. The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. Impacted is confidentiality.

The weakness was published 02/16/2021. The advisory is shared for download at openssl.org. This vulnerability is handled as CVE-2021-23839. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.

The vulnerability scanner Nessus provides a plugin with the ID 211827 (Oracle Linux 9 : edk2 (ELSA-2024-12842)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.0.2y or 1.1.1j eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.openssl.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (211827) and CERT Bund (WID-SEC-2022-0669). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Open Source CentOS
• Open Source OpenSSL
• Debian Linux
• Amazon Linux 2
• FreeBSD Project FreeBSD OS
• Juniper JUNOS
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• Hitachi Command Suite
• Gentoo Linux
• Open Source Arch Linux
• Avaya Aura Communication Manager
• Avaya Aura Session Manager
• Avaya Aura Application Enablement Services
• Avaya Aura System Manager
• Avaya Web License Manager
• Pulse Secure Pulse Connect Secure
• HCL BigFix
• Hitachi Ops Center
• Open Source Node.js
• Meinberg LANTIME
• Tenable Security Nessus
• Netscout Arbor AED
• Netscout Arbor APS
• Netscout Arbor Sightline
• Netscout Arbor TMS
• Tenable Security Nessus Network Monitor
• HPE Fabric OS
• Hitachi Configuration Manager
• F5 BIG-IP
• Trellix ePolicy Orchestrator
• IBM Rational Build Forge
• Dell NetWorker
• SolarWinds Platform
• F5 F5OS

Productinfo

Type

• Network Encryption Software

Name

• OpenSSL

Version

• 1.0.2x
• 1.1.1
• 1.1.1a
• 1.1.1b
• 1.1.1c
• 1.1.1d
• 1.1.1e
• 1.1.1f
• 1.1.1g
• 1.1.1h
• 1.1.1i

License

• open-source

Website

• Product: https://www.openssl.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion