CVE-2021-3449
Mediumopenssl: NULL pointer dereference in signature_algorithms processing
Published May 13, 2022 · Updated Oct 16, 2026 · Also known as ALPINE-CVE-2021-3449, BIT-node-2021-3449, BIT-node-min-2021-3449, DEBIAN-CVE-2021-3449, DSA-4875-1, EUVD-2021-1628, GHSA-83mx-573x-5rw9, JLSEC-2026-223, RUSTSEC-2021-0055, SUSE-SU-2021:0954-1, SUSE-SU-2021:0955-1, SUSE-SU-2021:0955-2, UBUNTU-CVE-2021-3449, USN-4891-1, USN-5038-1
Key Facts
Patch immediately- CVE-2021-3449 is a medium-severity vulnerability (CVSS 5.9 v3.1) affecting Web Gateway (Mcafee), Web Gateway Cloud Service (Mcafee), Active Iq Unified Manager (Netapp) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 64% probability of exploitation in the next 30 days.
- Fixed versions are available, including edk2-aarch64 20200801stable-1.amzn2.0.5, edk2-ovmf 20200801stable-1.amzn2.0.5, edk2-tools 20200801stable-1.amzn2.0.5.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
64%
Higher than 99.2% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2021-3449 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).
Affected Products
417 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Web GatewayMcafee | 10.1.1, 8.2.19, 9.2.10 | n/a |
| Web Gateway Cloud ServiceMcafee | 10.1.1, 8.2.19, 9.2.10 | n/a |
| Active Iq Unified ManagerNetapp | See advisory | n/a |
| Cloud Volumes Ontap MediatorNetapp | See advisory | n/a |
| E-Series Performance AnalyzerNetapp | See advisory | n/a |
Patched Releases
edk2-aarch64
20200801stable-1.amzn2.0.5
edk2-ovmf
20200801stable-1.amzn2.0.5
edk2-tools
20200801stable-1.amzn2.0.5
edk2-tools-doc
20200801stable-1.amzn2.0.5
edk2-tools-python
20200801stable-1.amzn2.0.5
jbcs-httpd24-httpd
0:2.4.37-70.jbcs.el7
jbcs-httpd24-mod_cluster-native
0:1.3.14-20.Final_redhat_2.jbcs.el7
jbcs-httpd24-mod_http2
0:1.15.7-14.jbcs.el7
jbcs-httpd24-mod_jk
0:1.2.48-13.redhat_1.jbcs.el7
jbcs-httpd24-mod_md
1:2.0.8-33.jbcs.el7
jbcs-httpd24-mod_security
0:2.9.2-60.GA.jbcs.el7
jbcs-httpd24-nghttp2
0:1.39.2-37.jbcs.el7
jbcs-httpd24-openssl
1:1.1.1g-6.jbcs.el7
jbcs-httpd24-openssl-chil
0:1.0.0-5.jbcs.el7
jbcs-httpd24-openssl-pkcs11
0:0.4.10-20.jbcs.el7
jws5-tomcat-native
0:1.2.25-4.redhat_4.el7jws, 0:1.2.25-4.redhat_4.el8jws
libopenssl-1_1-devel
1.1.1d-11.20.1, 1.1.1d-2.33.1, 1.1.1d-lp152.7.15.1, 1.1.1l-1.2
libopenssl-1_1-devel-32bit
1.1.1d-11.20.1, 1.1.1d-2.33.1, 1.1.1d-lp152.7.15.1, 1.1.1l-1.2
libopenssl1_1
1.1.1d-11.20.1, 1.1.1d-2.33.1, 1.1.1d-lp152.7.15.1, 1.1.1l-1.2
libopenssl1_1-32bit
1.1.1d-11.20.1, 1.1.1d-2.33.1, 1.1.1d-lp152.7.15.1, 1.1.1l-1.2
libopenssl1_1-hmac
1.1.1d-11.20.1, 1.1.1d-lp152.7.15.1, 1.1.1l-1.2
libopenssl1_1-hmac-32bit
1.1.1d-11.20.1, 1.1.1d-lp152.7.15.1
matrix-synapse
1.43.0-1.1
node
10.12.1, 10.24.1, 12.12.1, 12.22.1, 14.14.1, 14.16.1, 15.14.0
node-min
10.12.1, 10.24.1, 12.12.1, 12.22.1, 14.14.1, 14.16.1, 15.14.0
Timeline
Publicly disclosed
May 13, 2022
Last updated
Oct 16, 2026
Weakness Type
- CWE-476 NULL Pointer Dereference
References
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14779
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14781
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14792
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14796
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14797
FAQ
Common Questions.
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client.
Affected: Web Gateway (Mcafee) versions 10.1.1, 8.2.19, 9.2.10; Web Gateway Cloud Service (Mcafee) versions 10.1.1, 8.2.19, 9.2.10; Active Iq Unified Manager (Netapp), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including edk2-aarch64 20200801stable-1.amzn2.0.5, edk2-ovmf 20200801stable-1.amzn2.0.5, edk2-tools 20200801stable-1.amzn2.0.5.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2021-3449 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo