OpenSSL Vulnerability: Denial of Service Risk in X509_issuer_and_serial_hash Function
Summary
ALPINE-CVE-2021-23841: The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. Affects openssl versions < 1.1.1j-r0. Fixed in 1.1.1j-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is a widely-used open-source software library that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols for secure communication over computer networks. It provides a robust set of cryptographic functions and is integral to securing web traffic. However, certain versions of OpenSSL are vulnerable to a denial of service attack due to improper error handling in the X509_issuer_and_serial_hash function, which can lead to application crashes when processing maliciously crafted X509 certificates.
Vulnerability Detail
The vulnerability arises from the OpenSSL public API function X509_issuer_and_serial_hash(), which is responsible for generating a unique hash based on the issuer and serial number of an X509 certificate. If the issuer field is constructed maliciously, the function may fail to handle errors correctly, resulting in a NULL pointer dereference and subsequent application crash. This vulnerability primarily affects applications that directly use this function with untrusted certificates. OpenSSL versions 1.1.1i and below are impacted, with a CVSS score of 5.9 indicating a moderate severity level.
How To Fix
Minimum fixed version
1.1.1j-r0
This is the first release that contains the fix.
sudo apk add --upgrade opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, applications that utilize the X509_issuer_and_serial_hash function should implement additional validation checks on the issuer field of X509 certificates before invoking this function. This can help prevent the processing of potentially malicious certificates.
Conclusion
In summary, the OpenSSL vulnerability in the X509_issuer_and_serial_hash function poses a risk of denial of service attacks due to improper error handling. Users are strongly advised to upgrade to the patched version to ensure the security and stability of their applications.
See every vulnerability recorded for openssl →
FAQ
The vulnerability can lead to a denial of service attack, causing applications to crash when processing malicious X509 certificates.
OpenSSL versions 1.1.1i and below are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 5.9, indicating a moderate severity level.
The long-term solution is to upgrade to OpenSSL version 1.1.1j or later, which includes the necessary fixes.
References
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
