CVE-2021-3450: CA certificate check bypass with X509_V_FLAG_X509_STRICT
OpenSSL could allow a remote attacker to bypass security restrictions, caused by a a missing check in the validation logic of X.509 certificate chains by the X509VFLAGX509STRICT flag. By using any valid certificate or certificate chain to sign a specially crafted certificate, an attacker could bypass the check that non-CA certificates must not be able to issue other certificates and override the default purpose.
Other sources
The X509VFLAGX509STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a "purpose" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named "purpose" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509VFLAGX509STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/openssl-srcto a version that resolves this vulnerability.Fixed in 111.15.0 - Upgrade
Upgrade
OpenSSLto a version that resolves this vulnerability.Fixed in 1.1.1k - Configuration
Ensure the application does not explicitly set the X509_V_FLAG_X509_STRICT verification flag in affected OpenSSL versions, since the bypass is possible only when this flag is set and a purpose is not set or is overridden.
OpenSSL certificate verification (X509_V_FLAG_X509_STRICT) X509_V_FLAG_X509_STRICT = do not enable
Event History
Frequently Asked Questions
What is the severity of CVE-2021-3450?
CVE-2021-3450 is classified as critical due to its potential to allow remote attackers to bypass security restrictions.
How do I fix CVE-2021-3450?
To fix CVE-2021-3450, update OpenSSL to version 1.1.1k or higher, or apply patches provided by software vendors utilizing the affected libraries.
What systems are affected by CVE-2021-3450?
CVE-2021-3450 affects various versions of OpenSSL prior to 1.1.1k, and systems including IBM Security Verify Bridge and multiple embedded Linux distributions.
What type of vulnerability is CVE-2021-3450?
CVE-2021-3450 is an authentication bypass vulnerability that stems from a missing check in the validation logic of X.509 certificate chains.
Can CVE-2021-3450 be exploited remotely?
Yes, CVE-2021-3450 can be exploited remotely by attackers who manage to sign a specially crafted certificate.