Loading vulnerability…
CVE-2021-3712 is an out-of-bounds read in OpenSSL ASN.1 string handling. ASN1_STRING stores a data buffer and explicit length, but numerous ASN.1 printing functions incorrectly assumed its buffer was NUL-terminated. Applications can create valid non-NUL-terminated ASN1_STRING objects by directly setting their data and length fields or by using ASN1_STRING_set0(). Passing such objects to affected printing functions, X.509 name-constraints processing, X509_get1_email(), X509_REQ_get1_email(), or X509_get1_ocsp() can cause OpenSSL to read past the allocated buffer.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is not a weaponized exploit kit; it is a remediation lab and proof-of-concept repository centered on CVE-2021-3712 in OpenSSL. Its main offensive capability is a local C reproducer (`scripts/cve-2021-3712-repro.c`) that deliberately creates a non-NUL-terminated ASN.1 challenge string using `ASN1_OCTET_STRING_set0()` and invokes `NETSCAPE_SPKI_print()`. On vulnerable OpenSSL 1.0.2k-era builds, this reaches `%s`-based print paths and can cause out-of-bounds reads, valgrind-detectable invalid reads, potential adjacent heap disclosure, or process crash/DoS. Repository structure is primarily documentation plus build/verification automation: `README.adoc` and `docs/` describe CVE triage, CentOS 7 EOL container setup, SRPM extraction, patch preparation, RPM rebuild, mock verification, signing, and reporting. `Dockerfile` creates a CentOS 7 build environment using archived repositories. `scripts/run-phase5-verify.sh` automates building vulnerable and patched libcrypto variants, compiling the reproducer against each, and comparing valgrind output. `work/phase4/openssl-CVE-2021-3712-final.patch` contains the actual backport, replacing unsafe `%s` formatting with bounded `%.*s` and adding helper routines like `OPENSSL_strndup`/`OPENSSL_strnlen` for safer handling. The exploit capability is therefore limited but real: it demonstrates the vulnerability and validates the patch. It does not provide remote exploitation, persistence, privilege escalation, or code execution. The attack surface described in the docs is network-reachable in affected applications because remote peers may supply data that eventually reaches vulnerable OpenSSL print paths, but the included code itself is a local reproducer and verification harness. The large `work/rpmbuild-edited/BUILD/openssl-1.0.2k/` subtree is mostly extracted upstream/downstream OpenSSL source used as a packaging/build context rather than bespoke exploit logic.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability tracked as CVE-2021-3712 addressed by a Unity Linux security update (UTSA-2023-001491). The supplied content does not describe the affected component or technical flaw.
An OpenSSL vulnerability mentioned only in related content, not part of the main article.
Unknown; this CVE is listed among the release CVEs without a vulnerability description.
A vulnerability addressed by this advisory; no technical details are provided in the content.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.