漏洞信息详情
OpenSSL 输入验证错误漏洞
漏洞简介
OpenSSL是Openssl团队的一个开源的能够实现安全套接层(SSLv2/v3)和安全传输层(TLSv1)协议的通用加密库。该产品支持多种加密算法,包括对称密码、哈希算法、安全散列算法等。
OpenSSL public API 存在输入验证错误漏洞,该漏洞源于X509_issuer_and_serial_hash函数不能正确处理解析issuer字段时可能发生的任何错误。
漏洞公告
目前厂商已发布升级补丁以修复漏洞,补丁获取链接:
https://www.openssl.org/news/secadv/20210216.txt
参考网址
来源:CONFIRM
链接:https://support.apple.com/kb/HT212534
来源:CONFIRM
链接:https://security.netapp.com/advisory/ntap-20210513-0002/
来源:CONFIRM
链接:https://support.apple.com/kb/HT212529
来源:CONFIRM
链接:https://support.apple.com/kb/HT212528
来源:FULLDISC
链接:http://seclists.org/fulldisclosure/2021/May/70
来源:CONFIRM
链接:https://www.openssl.org/news/secadv/20210216.txt
来源:CONFIRM
链接:https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=122a19ab48091c657f7cb1fb3af9fc07bd557bbf
来源:CONFIRM
链接:https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846
来源:GENTOO
链接:https://security.gentoo.org/glsa/202103-03
来源:CONFIRM
链接:https://www.tenable.com/security/tns-2021-03
来源:DEBIAN
链接:https://www.debian.org/security/2021/dsa-4855
来源:N/A
链接:https://www.oracle.com//security-alerts/cpujul2021.html
来源:CONFIRM
链接:https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8252ee4d90f3f2004d3d0aeeed003ad49c9a7807
来源:CONFIRM
链接:https://security.netapp.com/advisory/ntap-20210219-0009/
来源:CONFIRM
链接:https://www.tenable.com/security/tns-2021-09
来源:MISC
链接:https://www.oracle.com/security-alerts/cpuoct2021.html
来源:FULLDISC
链接:http://seclists.org/fulldisclosure/2021/May/67
来源:FULLDISC
链接:http://seclists.org/fulldisclosure/2021/May/68
来源:MISC
链接:https://www.oracle.com/security-alerts/cpuApr2021.html
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2021.0916
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2021.0958
来源:www.oracle.com
链接:https://www.oracle.com/security-alerts/cpuapr2021.html
来源:www.oracle.com
链接:https://www.oracle.com/security-alerts/cpuoct2021.html
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2021.0832
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-openssl-may-affect-ibm-workload-scheduler-2/
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2021.2657
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2021.3905
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2021.0636
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-openssl-affect-ibm-spectrum-protect-backup-archive-client-netapp-services-cve-2020-1971-cve-2021-23840-cve-2021-23841/
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2021.3792
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilites-affect-engineering-lifecycle-management-and-ibm-engineering-products/
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2021.1015
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-openssl-publicly-disclosed-vulnerabilities-affect-messagegateway-cve-2021-23841-cve-2021-23840/
来源:packetstormsecurity.com
链接:https://packetstormsecurity.com/files/164890/Red-Hat-Security-Advisory-2021-4198-03.html
来源:packetstormsecurity.com
链接:https://packetstormsecurity.com/files/162041/Gentoo-Linux-Security-Advisory-202103-03.html
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-z-tpf-is-affected-by-openssl-vulnerabilities/
来源:packetstormsecurity.com
链接:https://packetstormsecurity.com/files/161525/Ubuntu-Security-Notice-USN-4745-1.html
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2021.1618
来源:packetstormsecurity.com
链接:https://packetstormsecurity.com/files/162823/Apple-Security-Advisory-2021-05-25-1.html
来源:support.apple.com
链接:https://support.apple.com/en-us/HT212529
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-openssl-affect-aix-cve-2021-23839-cve-2021-23840-and-cve-2021-23841/
来源:www.ibm.com
链接:https://www.ibm.com/support/pages/node/6486335
来源:vigilance.fr
链接:https://vigilance.fr/vulnerability/OpenSSL-NULL-pointer-dereference-via-X509-issuer-and-serial-hash-34598
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-openssl-vulnerabilites-impacting-aspera-high-speed-transfer-server-aspera-high-speed-transfer-endpoint-aspera-desktop-client-4-0-and-earlier-cve-2021-23839-cve-2021-23840-cve/
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2021.3485
来源:www.cybersecurity-help.cz
链接:https://www.cybersecurity-help.cz/vdb/SB2021042109
来源:packetstormsecurity.com
链接:https://packetstormsecurity.com/files/164562/Red-Hat-Security-Advisory-2021-3925-01.html
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-openssl-affect-aix-cve-2021-23839-cve-2021-23840-and-cve-2021-23841-2/
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-openssl-for-ibm-i-is-affected-by-cve-2021-23840-and-cve-2021-23841/
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnerabilities-fixed-in-openssl-as-shipped-with-ibm-security-verify-products/
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-was-identified-and-remediated-in-the-ibm-maas360-cloud-extender-v2-103-000-051-and-modules/
来源:www.cybersecurity-help.cz
链接:https://www.cybersecurity-help.cz/vdb/SB2021111137
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2021.0859
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-openssl-affect-ibm-tivoli-netcool-system-service-monitors-application-service-monitors/
来源:packetstormsecurity.com
链接:https://packetstormsecurity.com/files/164927/Red-Hat-Security-Advisory-2021-4614-01.html
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-openssl-vulnerabilities-affect-ibm-connectdirect-for-hp-nonstop/
来源:www.cybersecurity-help.cz
链接:https://www.cybersecurity-help.cz/vdb/SB2021051226
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2021.0897
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2021.0974
来源:www.ibm.com
链接:https://www.ibm.com/support/pages/node/6487493
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2021.3846
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2021.1502
来源:support.apple.com
链接:https://support.apple.com/en-us/HT212534
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2021.1225
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-websphere-mq-for-hp-nonstop-server-is-affected-by-multiple-openssl-vulnerabilities-cve-2021-23839-cve-2021-23840-and-cve-2021-23841/
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2021.4019
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2021.0616
来源:packetstormsecurity.com
链接:https://packetstormsecurity.com/files/161459/Ubuntu-Security-Notice-USN-4738-1.html
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-for-hp-nonstop-server-is-affected-by-openssl-vulnerabilities-cve-2021-23839-cve-2021-23840-and-cve-2021-23841/
来源:www.cybersecurity-help.cz
链接:https://www.cybersecurity-help.cz/vdb/SB2021111733
来源:www.cybersecurity-help.cz
链接:https://www.cybersecurity-help.cz/vdb/SB2021041501
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-connectexpress-for-unix-is-affected-by-multiple-vulnerabilities-in-openssl-2/
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2021.3375
来源:www.cybersecurity-help.cz
链接:https://www.cybersecurity-help.cz/vdb/SB2021101933
来源:www.ibm.com
链接:https://www.ibm.com/support/pages/node/6479349
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2021.1794
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2021.3499
来源:www.cybersecurity-help.cz
链接:https://www.cybersecurity-help.cz/vdb/SB2021052508
来源:www.cybersecurity-help.cz
链接:https://www.cybersecurity-help.cz/vdb/SB2021101330
来源:www.cybersecurity-help.cz
链接:https://www.cybersecurity-help.cz/vdb/SB2021052505
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-affect-ibm-sdk-for-node-js-in-ibm-cloud-5/
来源:packetstormsecurity.com
链接:https://packetstormsecurity.com/files/164583/Red-Hat-Security-Advisory-2021-3949-01.html
来源:nvd.nist.gov
链接:https://nvd.nist.gov/vuln/detail/CVE-2021-23841
来源:packetstormsecurity.com
链接:https://packetstormsecurity.com/files/162151/Red-Hat-Security-Advisory-2021-1168-01.html
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-openssl-affects-ibm-rational-clearcase-cve-2020-1971-cve-2021-23839-cve-2021-23840-cve-2021-23841-cve-2021-23839-cve-2021-23840-cve-2021-23841/
来源:packetstormsecurity.com
链接:https://packetstormsecurity.com/files/165096/Red-Hat-Security-Advisory-2021-4845-05.html
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2021.3935
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2021.0786
来源:www.ibm.com
链接:https://www.ibm.com/support/pages/node/6507581
来源:packetstormsecurity.com
链接:https://packetstormsecurity.com/files/165002/Red-Hat-Security-Advisory-2021-4032-01.html
来源:packetstormsecurity.com
链接:https://packetstormsecurity.com/files/165099/Red-Hat-Security-Advisory-2021-4848-07.html
来源:packetstormsecurity.com
链接:https://packetstormsecurity.com/files/161450/OpenSSL-Toolkit-1.1.1j.html
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2021.0670
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2021.0992
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-openssl-affect-ibm-spectrum-protect-backup-archive-client-netapp-services-cve-2020-1971-cve-2021-23840-cve-2021-23841-2/
来源:www.ibm.com
链接:https://www.ibm.com/support/pages/node/6490371
来源:packetstormsecurity.com
链接:https://packetstormsecurity.com/files/164489/Red-Hat-Security-Advisory-2021-3798-01.html
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-openssl-vulnerabilites-impacting-aspera-high-speed-transfer-server-aspera-high-speed-transfer-endpoint-aspera-desktop-client-4-0-and-earlier-cve-2021-23839-cve-2021-23840-cve-2/
来源:www.cybersecurity-help.cz
链接:https://www.cybersecurity-help.cz/vdb/SB2021102116
受影响实体
暂无
补丁
- OpenSSL 输入验证错误漏洞的修复措施<!--2021-2-16-->
还没有评论,来说两句吧...