Vulnerability in openssl (DEBIAN-CVE-2021-3712)
Summary
Vulnerability in openssl (DEBIAN-CVE-2021-3712). Confidential information can be exposed externally. Mitigation: upgrade to 1.1.1l-1 or later.
Original description
The description as published by the source.
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the applicatio…
Source: OSV.dev (Open Source Vulnerabilities) OSV
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as DEBIAN-CVE-2021-3712 has been found in openssl.
Confidential information can be exposed externally.
What to do: upgrade openssl to 1.1.1l-1 or later.
If unsure, ask your IT team or search "openssl DEBIAN-CVE-2021-3712" on the vendor's site.
DEBIAN-CVE-2021-3712 (openssl)
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Affected: 1.1.1 - 1.1.1k
Patched: 1.1.1l-1 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (unclassified) exists in openssl.
Affected versions of openssl: 1.1.1 - 1.1.1k.
Severity: ?. Confidential information can be exposed externally.
Update to 1.1.1l-1. (If a vulnerable version 1.1.1 - 1.1.1k is in production, plan an immediate maintenance window.)
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'openssl' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'openssl' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
opensslを grep し、稼働しているサービス・バージョンを把握する。 -
2Match against affected range verify
Confirm if version satisfies `1.1.1 - 1.1.1k`Step 1 で見つかったバージョンが影響範囲
1.1.1 - 1.1.1kに該当するか照合。本番で稼働中ならインシデント扱い。 -
3Apply patch patch
Upgrade openssl to 1.1.1l-1ステージング環境で 1.1.1l-1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
4Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory security-tracker.debian.org