UBUNTU-CVE-2021-3712

See a problem?
Source
https://ubuntu.com/security/notices/UBUNTU-CVE-2021-3712
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-3712.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2021-3712
Related
Published
2021-08-24T00:00:00Z
Modified
2021-08-24T00:00:00Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H CVSS Calculator
Summary
[none]
Details

ASN.1 strings are represented internally within OpenSSL as an ASN1STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1STRINGset() function will additionally NUL terminate the byte array in the ASN1STRING structure. However, it is possible for applications to directly construct valid ASN1STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1STRING array. This can also happen by using the ASN1STRINGset0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1STRING structures). It can also occur in the X509get1email(), X509REQget1email() and X509get1ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y).

References

Affected packages

Ubuntu:Pro:14.04:LTS / openssl

Package

Name
openssl
Purl
pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.27+esm4?arch=src?distro=trusty/esm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.0.1f-1ubuntu2.27+esm4

Affected versions

1.*

1.0.1e-3ubuntu1
1.0.1e-4ubuntu1
1.0.1e-4ubuntu2
1.0.1e-4ubuntu3
1.0.1e-4ubuntu4
1.0.1f-1ubuntu1
1.0.1f-1ubuntu2
1.0.1f-1ubuntu2.1
1.0.1f-1ubuntu2.2
1.0.1f-1ubuntu2.3
1.0.1f-1ubuntu2.4
1.0.1f-1ubuntu2.5
1.0.1f-1ubuntu2.7
1.0.1f-1ubuntu2.8
1.0.1f-1ubuntu2.11
1.0.1f-1ubuntu2.12
1.0.1f-1ubuntu2.15
1.0.1f-1ubuntu2.16
1.0.1f-1ubuntu2.17
1.0.1f-1ubuntu2.18
1.0.1f-1ubuntu2.19
1.0.1f-1ubuntu2.20
1.0.1f-1ubuntu2.21
1.0.1f-1ubuntu2.22
1.0.1f-1ubuntu2.23
1.0.1f-1ubuntu2.24
1.0.1f-1ubuntu2.25
1.0.1f-1ubuntu2.26
1.0.1f-1ubuntu2.27
1.0.1f-1ubuntu2.27+esm1
1.0.1f-1ubuntu2.27+esm2
1.0.1f-1ubuntu2.27+esm3

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "libssl1.0.0-udeb-dbgsym": "1.0.1f-1ubuntu2.27+esm4",
            "libssl-dev": "1.0.1f-1ubuntu2.27+esm4",
            "libssl1.0.0": "1.0.1f-1ubuntu2.27+esm4",
            "libssl-doc": "1.0.1f-1ubuntu2.27+esm4",
            "libcrypto1.0.0-udeb-dbgsym": "1.0.1f-1ubuntu2.27+esm4",
            "libssl1.0.0-dbg": "1.0.1f-1ubuntu2.27+esm4",
            "libssl-dev-dbgsym": "1.0.1f-1ubuntu2.27+esm4",
            "openssl": "1.0.1f-1ubuntu2.27+esm4",
            "openssl-dbgsym": "1.0.1f-1ubuntu2.27+esm4",
            "libssl1.0.0-udeb": "1.0.1f-1ubuntu2.27+esm4",
            "libssl1.0.0-dbgsym": "1.0.1f-1ubuntu2.27+esm4",
            "libcrypto1.0.0-udeb": "1.0.1f-1ubuntu2.27+esm4"
        }
    ]
}

Ubuntu:Pro:16.04:LTS / openssl

Package

Name
openssl
Purl
pkg:deb/ubuntu/openssl@1.0.2g-1ubuntu4.20+esm1?arch=src?distro=esm-infra/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.0.2g-1ubuntu4.20+esm1

Affected versions

1.*

1.0.2d-0ubuntu1
1.0.2d-0ubuntu2
1.0.2e-1ubuntu1
1.0.2f-2ubuntu1
1.0.2g-1ubuntu2
1.0.2g-1ubuntu3
1.0.2g-1ubuntu4
1.0.2g-1ubuntu4.1
1.0.2g-1ubuntu4.2
1.0.2g-1ubuntu4.4
1.0.2g-1ubuntu4.5
1.0.2g-1ubuntu4.6
1.0.2g-1ubuntu4.8
1.0.2g-1ubuntu4.9
1.0.2g-1ubuntu4.10
1.0.2g-1ubuntu4.11
1.0.2g-1ubuntu4.12
1.0.2g-1ubuntu4.13
1.0.2g-1ubuntu4.14
1.0.2g-1ubuntu4.15
1.0.2g-1ubuntu4.16
1.0.2g-1ubuntu4.17
1.0.2g-1ubuntu4.18
1.0.2g-1ubuntu4.19
1.0.2g-1ubuntu4.20

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "libssl1.0.0-udeb-dbgsym": "1.0.2g-1ubuntu4.20+esm1",
            "libssl-dev": "1.0.2g-1ubuntu4.20+esm1",
            "libssl1.0.0": "1.0.2g-1ubuntu4.20+esm1",
            "libssl-doc": "1.0.2g-1ubuntu4.20+esm1",
            "libcrypto1.0.0-udeb-dbgsym": "1.0.2g-1ubuntu4.20+esm1",
            "libssl1.0.0-dbg": "1.0.2g-1ubuntu4.20+esm1",
            "libssl-dev-dbgsym": "1.0.2g-1ubuntu4.20+esm1",
            "openssl": "1.0.2g-1ubuntu4.20+esm1",
            "openssl-dbgsym": "1.0.2g-1ubuntu4.20+esm1",
            "libssl1.0.0-udeb": "1.0.2g-1ubuntu4.20+esm1",
            "libssl1.0.0-dbgsym": "1.0.2g-1ubuntu4.20+esm1",
            "libcrypto1.0.0-udeb": "1.0.2g-1ubuntu4.20+esm1"
        }
    ]
}

Ubuntu:Pro:16.04:LTS / edk2

Package

Name
edk2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0~20150106.*

0~20150106.5c2d456b-2

0~20160104.*

0~20160104.c2a892d7-1

0~20160408.*

0~20160408.ffea0a2c-2
0~20160408.ffea0a2c-2ubuntu0.1
0~20160408.ffea0a2c-2ubuntu0.2
0~20160408.ffea0a2c-2ubuntu0.2+esm1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:18.04:LTS / openssl

Package

Name
openssl
Purl
pkg:deb/ubuntu/openssl@1.1.1-1ubuntu2.1~18.04.13?arch=src?distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.1-1ubuntu2.1~18.04.13

Affected versions

1.*

1.0.2g-1ubuntu13
1.0.2g-1ubuntu14
1.0.2n-1ubuntu1
1.1.0g-2ubuntu1
1.1.0g-2ubuntu2
1.1.0g-2ubuntu3
1.1.0g-2ubuntu4
1.1.0g-2ubuntu4.1
1.1.0g-2ubuntu4.3
1.1.1-1ubuntu2.1~18.04.1
1.1.1-1ubuntu2.1~18.04.2
1.1.1-1ubuntu2.1~18.04.3
1.1.1-1ubuntu2.1~18.04.4
1.1.1-1ubuntu2.1~18.04.5
1.1.1-1ubuntu2.1~18.04.6
1.1.1-1ubuntu2.1~18.04.7
1.1.1-1ubuntu2.1~18.04.8
1.1.1-1ubuntu2.1~18.04.9
1.1.1-1ubuntu2.1~18.04.10

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "libssl-doc": "1.1.1-1ubuntu2.1~18.04.13",
            "libssl-dev": "1.1.1-1ubuntu2.1~18.04.13",
            "libssl1.1-dbgsym": "1.1.1-1ubuntu2.1~18.04.13",
            "libssl1.1-udeb": "1.1.1-1ubuntu2.1~18.04.13",
            "libssl1.1": "1.1.1-1ubuntu2.1~18.04.13",
            "openssl-dbgsym": "1.1.1-1ubuntu2.1~18.04.13",
            "libcrypto1.1-udeb": "1.1.1-1ubuntu2.1~18.04.13",
            "openssl": "1.1.1-1ubuntu2.1~18.04.13"
        }
    ]
}

Ubuntu:18.04:LTS / openssl1.0

Package

Name
openssl1.0
Purl
pkg:deb/ubuntu/openssl1.0@1.0.2n-1ubuntu5.7?arch=src?distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.0.2n-1ubuntu5.7

Affected versions

1.*

1.0.2n-1ubuntu2
1.0.2n-1ubuntu3
1.0.2n-1ubuntu4
1.0.2n-1ubuntu5
1.0.2n-1ubuntu5.1
1.0.2n-1ubuntu5.2
1.0.2n-1ubuntu5.3
1.0.2n-1ubuntu5.4
1.0.2n-1ubuntu5.5
1.0.2n-1ubuntu5.6

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "libssl1.0.0-dbgsym": "1.0.2n-1ubuntu5.7",
            "libssl1.0-dev": "1.0.2n-1ubuntu5.7",
            "openssl1.0": "1.0.2n-1ubuntu5.7",
            "openssl1.0-dbgsym": "1.0.2n-1ubuntu5.7",
            "libssl1.0.0-udeb": "1.0.2n-1ubuntu5.7",
            "libssl1.0.0": "1.0.2n-1ubuntu5.7",
            "libcrypto1.0.0-udeb": "1.0.2n-1ubuntu5.7"
        }
    ]
}

Ubuntu:Pro:18.04:LTS / edk2

Package

Name
edk2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0~20170911.*

0~20170911.5dfba97c-1

0~20171010.*

0~20171010.234dbcef-1

0~20171027.*

0~20171027.76fd5a66-1

0~20171205.*

0~20171205.a9212288-1

0~20180105.*

0~20180105.0bc94c74-1

0~20180205.*

0~20180205.c0d9813c-1
0~20180205.c0d9813c-2
0~20180205.c0d9813c-2ubuntu0.1
0~20180205.c0d9813c-2ubuntu0.2
0~20180205.c0d9813c-2ubuntu0.3
0~20180205.c0d9813c-2ubuntu0.3+esm1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:20.04:LTS / edk2

Package

Name
edk2
Purl
pkg:deb/ubuntu/edk2@0~20191122.bd85bf54-2ubuntu3.3?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0~20191122.bd85bf54-2ubuntu3.3

Affected versions

0~20190606.*

0~20190606.20d2e5a1-2ubuntu1

0~20190828.*

0~20190828.37eef910-3
0~20190828.37eef910-4

0~20191122.*

0~20191122.bd85bf54-1
0~20191122.bd85bf54-1ubuntu1
0~20191122.bd85bf54-2
0~20191122.bd85bf54-2ubuntu1
0~20191122.bd85bf54-2ubuntu2
0~20191122.bd85bf54-2ubuntu3
0~20191122.bd85bf54-2ubuntu3.1
0~20191122.bd85bf54-2ubuntu3.2

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "qemu-efi-aarch64": "0~20191122.bd85bf54-2ubuntu3.3",
            "ovmf": "0~20191122.bd85bf54-2ubuntu3.3",
            "qemu-efi": "0~20191122.bd85bf54-2ubuntu3.3",
            "qemu-efi-arm": "0~20191122.bd85bf54-2ubuntu3.3"
        }
    ]
}

Ubuntu:20.04:LTS / openssl

Package

Name
openssl
Purl
pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.8?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.1f-1ubuntu2.8

Affected versions

1.*

1.1.1c-1ubuntu4
1.1.1d-2ubuntu3
1.1.1d-2ubuntu6
1.1.1f-1ubuntu1
1.1.1f-1ubuntu2
1.1.1f-1ubuntu2.1
1.1.1f-1ubuntu2.2
1.1.1f-1ubuntu2.3
1.1.1f-1ubuntu2.4
1.1.1f-1ubuntu2.5

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "libssl-doc": "1.1.1f-1ubuntu2.8",
            "libssl-dev": "1.1.1f-1ubuntu2.8",
            "libssl1.1-dbgsym": "1.1.1f-1ubuntu2.8",
            "libssl1.1-udeb": "1.1.1f-1ubuntu2.8",
            "libssl1.1": "1.1.1f-1ubuntu2.8",
            "openssl-dbgsym": "1.1.1f-1ubuntu2.8",
            "libcrypto1.1-udeb": "1.1.1f-1ubuntu2.8",
            "openssl": "1.1.1f-1ubuntu2.8"
        }
    ]
}

Ubuntu:22.04:LTS / edk2

Package

Name
edk2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2021.*

2021.08~rc0-2
2021.08-3
2021.11~rc1-1
2021.11-1
2021.11-2

2022.*

2022.02~rc1-1
2022.02~rc1-1ubuntu1
2022.02-1
2022.02-2
2022.02-3
2022.02-3ubuntu0.22.04.1
2022.02-3ubuntu0.22.04.2

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:22.04:LTS / nodejs

Package

Name
nodejs
Purl
pkg:deb/ubuntu/nodejs@12.22.9~dfsg-1ubuntu3?arch=src?distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
12.22.9~dfsg-1ubuntu3

Affected versions

12.*

12.22.5~dfsg-5ubuntu1
12.22.7~dfsg-2ubuntu1
12.22.7~dfsg-2ubuntu3
12.22.9~dfsg-1ubuntu2

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "nodejs-doc": "12.22.9~dfsg-1ubuntu3",
            "libnode72": "12.22.9~dfsg-1ubuntu3",
            "nodejs": "12.22.9~dfsg-1ubuntu3",
            "libnode-dev": "12.22.9~dfsg-1ubuntu3",
            "libnode72-dbgsym": "12.22.9~dfsg-1ubuntu3",
            "nodejs-dbgsym": "12.22.9~dfsg-1ubuntu3"
        }
    ]
}

Ubuntu:22.04:LTS / openssl

Package

Name
openssl
Purl
pkg:deb/ubuntu/openssl@1.1.1l-1ubuntu1?arch=src?distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.1l-1ubuntu1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "libssl-dev": "1.1.1l-1ubuntu1",
            "openssl-dbgsym": "1.1.1l-1ubuntu1",
            "libssl1.1": "1.1.1l-1ubuntu1",
            "libssl1.1-dbgsym": "1.1.1l-1ubuntu1",
            "openssl": "1.1.1l-1ubuntu1",
            "libssl-doc": "1.1.1l-1ubuntu1"
        }
    ]
}