Loading vulnerability…
Incorrect SSLv2 Rollback Protection in OpenSSL
CVE-2021-23839 is an inverted SSLv2 rollback-protection check in OpenSSL 1.0.2s through 1.0.2x. The RSA_padding_check_SSLv23() function incorrectly accepts padding that signals a protocol rollback and rejects padding associated with legitimate SSLv2-only clients. A server supporting both SSLv2 and newer SSL/TLS versions can consequently accept an SSLv2 connection that should have been rejected as a downgrade attempt. The error also affects the RSA_SSLV23_PADDING mode. OpenSSL 1.1.1 contains the affected padding functionality but does not support SSLv2, so the behavior is classified as a functional bug rather than this protocol security vulnerability in that branch.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A man-in-the-middle attacker may defeat protocol rollback protection and downgrade a newly established SSL/TLS connection to SSLv2, undermining the intended protocol-version security guarantees. The inverted check also causes affected servers to reject legitimate SSLv2 connection attempts that lack rollback-indicating padding.
If you can’t patch tonight, do this now.
Disable SSLv2 at runtime and remove SSLv2 cipher suites from the enabled cipher configuration. For applications using the OpenSSL context options, ensure SSL_OP_NO_SSLv2 remains set. Rebuilding OpenSSL without SSLv2 support also removes the protocol exposure. SSLv2 support and cipher suites are not enabled by default.
Patch, then assume compromise.
OpenSSL 1.0.2 premium-support customers should install 1.0.2y, which fixes the vulnerability, or an applicable later fixed release. Other users should migrate away from the publicly unsupported 1.0.2 branch to a currently supported OpenSSL release. The original migration recommendation was OpenSSL 1.1.1j; the 1.1.1 branch does not support SSLv2. For affected BigFix OS Deployment Bare Metal Server installations, the specified vendor fix is version 310.86.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.