Loading vulnerability…
Denial of Service in OpenSSL X509_issuer_and_serial_hash()
CVE-2021-23841 is a NULL-pointer dereference vulnerability in OpenSSL's public X509_issuer_and_serial_hash() API, which computes a hash from an X.509 certificate's issuer and serial number. The function incorrectly handles errors encountered while parsing a maliciously constructed issuer field, potentially causing the calling application to crash. OpenSSL does not call this function internally; exposure is limited to applications that directly invoke it on untrusted certificates. Affected upstream releases are OpenSSL 1.1.1 through 1.1.1i and 1.0.2 through 1.0.2x.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can crash the application processing the certificate, causing denial of service and interrupting services hosted by that process. No confidentiality or integrity impact is documented.
If you can’t patch tonight, do this now.
Avoid invoking X509_issuer_and_serial_hash() on certificates from untrusted sources. Where feasible, disable application functionality that passes attacker-controlled certificates to this API until the fix is deployed. No general OpenSSL configuration workaround is documented.
Patch, then assume compromise.
The upstream fixes were released in OpenSSL 1.1.1j and 1.0.2y, with the latter available to premium-support customers because the 1.0.2 branch was outside public support. Deploy a currently supported OpenSSL release containing the fix or the applicable vendor-patched package. Red Hat fixes include OpenSSL 1.0.2k-22.el7_9 for RHEL 7 and 1.1.1k-4.el8 for RHEL 8. Update affected bundled copies as well as system libraries. Restart applications and services linked against OpenSSL, or reboot, to load the corrected library.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.