March 25, 2021 | Security intelligence

OpenSSL fixes a security issue affecting several vendors and services

Loading table of contents...

On 25 March 2021, OpenSSL released its version 1.1.1k to fix two security issues. The flaws, tracked as CVE-2021-3450 and CVE 2021-3449, affect a variety of recent OpenSSL versions and apply to specific configurations.

Details

The first vulnerability, CVE-2021-3450, only impacts niche non-standard configurations (with X509_V_FLAG_X509_STRICT mode) in versions of OpenSSL 1.1.1h and newer.
The second, CVE-2021-3449, affects all OpenSSL 1.1.1 versions when OpenSSL TLS servers are running default configurations (with TLSv1.2 and renegotiation enabled). OpenSSL TLS clients are not impacted by this issue.
At the time of writing, Ubuntu, WindRiver, Launchpad.net, Debian, and AlpineLinux announced that they are applying the patches for these issues.

Why it's important

There is a high risk associated with OpenSSL vulnerabilities as threat actors often exploit them for malicious purposes.
OpenSSL is the most popular open-source cryptographic library and TLS (transport layer security) implementation used to encrypt traffic on the Internet.
Malicious actors could abuse the flaw detailed in the CVE-2021-3449 to cause a denial-of-service (DOS) by sending maliciously-crafted data to the server.
The issue is likely to affect servers using OpenSSL on the Internet, including web and mail servers. If network appliances use OpenSSL and are exposed to the Internet, they too would be vulnerable.
All end-user-facing software running any version of 1.1.1 with renegotiation enabled may be vulnerable.

Mitigation

We recommend monitoring for updates and guidance from operating systems, distribution, appliance, software vendors and service providers, and applying updates as they become available.
In order to determine if OpenSSL is running and the version, we recommend administrators run the "OpenSSL version" command on their appliances (terminal).
Follow OpenSSL guidance on updating and configuring the implementations.
TLS1.3 is supported in up-to-date major web browsers. Consider disabling TLS1.2, where possible.
Update OpenSSL libraries to version 1.1.1k along with operating system patches to keep the server secure.
Note: A reboot is required as patching without a reboot leaves vulnerable code in memory, and the patched version on disk and the server remain vulnerable.