PT-2021-6992 · Openssl+1 · Openssl+1

Bernd Edlinger · Published 2021-12-10 · Updated 2026-04-27 · CVE-2021-4160

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.0.2 through 1.0.2zb OpenSSL versions 1.1.1 through 1.1.1l OpenSSL version 3.0.0

Description The issue is related to a carry propagation bug in the MIPS32 and MIPS64 squaring procedure of the OpenSSL library, which can lead to the compromise of elliptic curve algorithms, including some of the TLS 1.3 default curves. This bug may allow a remote attacker to disclose protected information, particularly if private keys are reused. However, the prerequisites for an attack are considered unlikely, and the impact was not analyzed in detail. The amount of resources required for such an attack would be significant.

Recommendations For OpenSSL versions 1.0.2 through 1.0.2zb, update to version 1.0.2zc or apply the fix from git commit 6fc1aaaf3. For OpenSSL versions 1.1.1 through 1.1.1l, update to version 1.1.1m. For OpenSSL version 3.0.0, update to version 3.0.1.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Information Disclosure

Weakness Enumeration

CWE-327

CWE-200

Related Identifiers

ALT-PU-2022-1227

ALT-PU-2022-1515

ALT-PU-2022-1543

ALT-PU-2022-1562

AZL-8472

BDU:2022-02820

CVE-2021-4160

DSA-5103-1

JLSEC-2026-226

Affected Products

Alt Linux

Openssl

References · 40

• 🔥 https://github.com/drago-96/CVE-2022-0778 · Exploit
• 🔥 https://github.com/yywing/cve-2022-0778 · Exploit
• 🔥 https://github.com/jkakavas/CVE-2022-0778-POC · Exploit
• https://debian.org/security/2022/dsa-5103 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-4160 · Vendor Advisory
• https://osv.dev/vulnerability/JLSEC-2026-226 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5103-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-4160 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4160 · Security Note
• https://bdu.fstec.ru/vul/2022-02820 · Security Note
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-4160 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-8472 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-4160 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-4160 · Security Note