CVE-2021-3450 (High) detected in openssl-src-111.14.0+1.1.1j.crate - autoclosed

[mend-for-github-com[bot]]

CVE-2021-3450 - High Severity Vulnerability

Vulnerable Library - openssl-src-111.14.0+1.1.1j.crate

Source of OpenSSL and logic to build it.

Library home page: https://crates.io/api/v1/crates/openssl-src/111.14.0+1.1.1j/download

Dependency Hierarchy: - rustsec-0.23.3.crate (Root Library) - cargo-edit-0.7.0.crate - reqwest-0.10.10.crate - tokio-tls-0.3.1.crate - native-tls-0.2.7.crate - openssl-0.10.32.crate - openssl-sys-0.9.60.crate - :x: **openssl-src-111.14.0+1.1.1j.crate** (Vulnerable Library)

Found in HEAD commit: 91b6c7a5fffc4969d7d1185aecc6179ebcf18f48

Found in base branch: main

Vulnerability Details

The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a "purpose" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named "purpose" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j).

Publish Date: 2021-03-25

URL: CVE-2021-3450

CVSS 3 Score Details (7.4)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3450

Release Date: 2021-03-25

Fix Resolution: 1.1.1k

[mend-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.

[mend-for-github-com[bot]]

:information_source: This issue was automatically re-opened by WhiteSource because the vulnerable library in the specific branch(es) has been detected in the WhiteSource inventory.

[mend-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.