PT-2021-6445 · Openssl · Openssl

Published 2021-10-21 · Updated 2022-03-30 · CVE-2021-43085

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenSSL versions 3.0

Description The issue is related to an error in the CMAC Final() function implementation, which can lead to incorrect encryption results. This can potentially allow a remote attacker to access protected information.

Recommendations For OpenSSL version 3.0, consider disabling the CMAC Final() function as a temporary workaround until a patch is available. Restrict access to sensitive data to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

BDU:2022-01626

CVE-2021-43085

Affected Products

Openssl

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-43085 · Security Note
• https://bdu.fstec.ru/vul/2022-01626 · Security Note
• https://github.com/openssl/openssl/issues/16873 · Note
• https://security.snyk.io/vuln/SNYK-UNMANAGED-OPENSSL-2433331 · Note
• https://vuldb.com/ru/?id.195756 · Note
• https://t.me/cibsecurity/39506 · Telegram Post