rustsec-2021-0129
Vulnerability from osv_rustsec
Internally libssl in OpenSSL calls X509_verify_cert() on the client side to
verify a certificate supplied by a server. That function may return a negative
return value to indicate an internal error (for example out of memory). Such a
negative return value is mishandled by OpenSSL and will cause an IO function
(such as SSL_connect() or SSL_do_handshake()) to not indicate success and a
subsequent call to SSL_get_error() to return the value
SSL_ERROR_WANT_RETRY_VERIFY. This return value is only supposed to be returned
by OpenSSL if the application has previously called
SSL_CTX_set_cert_verify_callback(). Since most applications do not do this the
SSL_ERROR_WANT_RETRY_VERIFY return value from SSL_get_error() will be totally
unexpected and applications may not behave correctly as a result. The exact
behaviour will depend on the application but it could result in crashes,
infinite loops or other similar incorrect responses.
This issue is made more serious in combination with a separate bug in OpenSSL
3.0 that will cause X509_verify_cert() to indicate an internal error when
processing a certificate chain. This will occur where a certificate does not
include the Subject Alternative Name extension but where a Certificate Authority
has enforced name constraints. This issue can occur even with valid chains.
{
"affected": [
{
"database_specific": {
"categories": [
"denial-of-service"
],
"cvss": null,
"informational": null
},
"ecosystem_specific": {
"affected_functions": null,
"affects": {
"arch": [],
"functions": [],
"os": []
}
},
"package": {
"ecosystem": "crates.io",
"name": "openssl-src",
"purl": "pkg:cargo/openssl-src"
},
"ranges": [
{
"events": [
{
"introduced": "300.0.0"
},
{
"fixed": "300.0.4"
}
],
"type": "SEMVER"
}
],
"versions": []
}
],
"aliases": [
"CVE-2021-4044",
"GHSA-mmjf-f5jw-w72q"
],
"database_specific": {
"license": "CC0-1.0"
},
"details": "Internally libssl in OpenSSL calls `X509_verify_cert()` on the client side to\nverify a certificate supplied by a server. That function may return a negative\nreturn value to indicate an internal error (for example out of memory). Such a\nnegative return value is mishandled by OpenSSL and will cause an IO function\n(such as `SSL_connect()` or `SSL_do_handshake()`) to not indicate success and a\nsubsequent call to `SSL_get_error()` to return the value\n`SSL_ERROR_WANT_RETRY_VERIFY`. This return value is only supposed to be returned\nby OpenSSL if the application has previously called\n`SSL_CTX_set_cert_verify_callback()`. Since most applications do not do this the\n`SSL_ERROR_WANT_RETRY_VERIFY` return value from `SSL_get_error()` will be totally\nunexpected and applications may not behave correctly as a result. The exact\nbehaviour will depend on the application but it could result in crashes,\ninfinite loops or other similar incorrect responses.\n\nThis issue is made more serious in combination with a separate bug in OpenSSL\n3.0 that will cause `X509_verify_cert()` to indicate an internal error when\nprocessing a certificate chain. This will occur where a certificate does not\ninclude the Subject Alternative Name extension but where a Certificate Authority\nhas enforced name constraints. This issue can occur even with valid chains.",
"id": "RUSTSEC-2021-0129",
"modified": "2023-06-13T13:10:24Z",
"published": "2021-12-14T12:00:00Z",
"references": [
{
"type": "PACKAGE",
"url": "https://crates.io/crates/openssl-src"
},
{
"type": "ADVISORY",
"url": "https://rustsec.org/advisories/RUSTSEC-2021-0129.html"
},
{
"type": "WEB",
"url": "https://www.openssl.org/news/secadv/20211214.txt"
}
],
"related": [],
"severity": [],
"summary": "Invalid handling of `X509_verify_cert()` internal errors in libssl"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.