Loading vulnerability…
CVE-2021-3712 is an out-of-bounds read vulnerability in OpenSSL’s handling of ASN.1 string data. OpenSSL internally represents ASN.1 strings with an ASN1_STRING structure containing a data buffer and an explicit length field, but multiple affected functions incorrectly assume the underlying byte array is NUL terminated. When an application directly constructs an ASN1_STRING object by manually setting its data and length fields, or by using ASN1_STRING_set0(), the buffer may be valid but not NUL terminated. If such a structure is later processed by vulnerable OpenSSL routines that print ASN.1 data, perform certificate name constraints processing, or call functions such as X509_get1_email(), X509_REQ_get1_email(), or X509_get1_ocsp(), OpenSSL can read past the end of the buffer. This read buffer overrun can expose adjacent process memory or trigger a crash. Affected versions include OpenSSL 1.1.1 through 1.1.1k and OpenSSL 1.0.2 through 1.0.2y.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is not a weaponized exploit kit; it is a remediation lab and proof-of-concept repository centered on CVE-2021-3712 in OpenSSL. Its main offensive capability is a local C reproducer (`scripts/cve-2021-3712-repro.c`) that deliberately creates a non-NUL-terminated ASN.1 challenge string using `ASN1_OCTET_STRING_set0()` and invokes `NETSCAPE_SPKI_print()`. On vulnerable OpenSSL 1.0.2k-era builds, this reaches `%s`-based print paths and can cause out-of-bounds reads, valgrind-detectable invalid reads, potential adjacent heap disclosure, or process crash/DoS. Repository structure is primarily documentation plus build/verification automation: `README.adoc` and `docs/` describe CVE triage, CentOS 7 EOL container setup, SRPM extraction, patch preparation, RPM rebuild, mock verification, signing, and reporting. `Dockerfile` creates a CentOS 7 build environment using archived repositories. `scripts/run-phase5-verify.sh` automates building vulnerable and patched libcrypto variants, compiling the reproducer against each, and comparing valgrind output. `work/phase4/openssl-CVE-2021-3712-final.patch` contains the actual backport, replacing unsafe `%s` formatting with bounded `%.*s` and adding helper routines like `OPENSSL_strndup`/`OPENSSL_strnlen` for safer handling. The exploit capability is therefore limited but real: it demonstrates the vulnerability and validates the patch. It does not provide remote exploitation, persistence, privilege escalation, or code execution. The attack surface described in the docs is network-reachable in affected applications because remote peers may supply data that eventually reaches vulnerable OpenSSL print paths, but the included code itself is a local reproducer and verification harness. The large `work/rpmbuild-edited/BUILD/openssl-1.0.2k/` subtree is mostly extracted upstream/downstream OpenSSL source used as a packaging/build context rather than bespoke exploit logic.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An OpenSSL vulnerability mentioned only in related content, not part of the main article.
A moderate-severity OpenSSL read buffer overrun caused by affected functions assuming ASN1_STRING data is NUL terminated when directly constructed strings may not be, potentially leading to denial of service or disclosure of sensitive memory contents.
An OpenSSL vulnerability involving read buffer overruns while processing ASN.1 strings.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.