Test ID:	1.3.6.1.4.1.25623.1.0.145404
Category:	Denial of Service
Title:	OpenSSL: Null pointer deref in X509_issuer_and_serial_hash() (CVE-2021-23841) - Windows
Summary:	OpenSSL is prone to a denial of service (DoS) vulnerability.
Description:	Summary: OpenSSL is prone to a denial of service (DoS) vulnerability. Vulnerability Insight: The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). Vulnerability Impact: This vulnerability may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. Affected Software/OS: OpenSSL version 1.0.2x and prior and 1.1.1i and prior. Solution: Update to version 1.0.2y, 1.1.1j or later. See the references for more details. CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2021-23841 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=122a19ab48091c657f7cb1fb3af9fc07bd557bbf https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8252ee4d90f3f2004d3d0aeeed003ad49c9a7807 https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846 https://security.netapp.com/advisory/ntap-20210219-0009/ https://security.netapp.com/advisory/ntap-20210513-0002/ https://support.apple.com/kb/HT212528 https://support.apple.com/kb/HT212529 https://support.apple.com/kb/HT212534 https://www.openssl.org/news/secadv/20210216.txt https://www.tenable.com/security/tns-2021-03 https://www.tenable.com/security/tns-2021-09 Debian Security Information: DSA-4855 (Google Search) https://www.debian.org/security/2021/dsa-4855 http://seclists.org/fulldisclosure/2021/May/67 http://seclists.org/fulldisclosure/2021/May/70 http://seclists.org/fulldisclosure/2021/May/68 https://security.gentoo.org/glsa/202103-03 https://www.oracle.com//security-alerts/cpujul2021.html https://www.oracle.com/security-alerts/cpuApr2021.html https://www.oracle.com/security-alerts/cpuapr2022.html https://www.oracle.com/security-alerts/cpuoct2021.html
Copyright	Copyright (C) 2021 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.