CVE-2021-3450: CA certificate check bypass with X509_V_FLAG_X509_STRICT
OpenSSL could allow a remote attacker to bypass security restrictions, caused by a a missing check in the validation logic of X.509 certificate chains by the X509_V_FLAG_X509_STRICT flag. By using any valid certificate or certificate chain to sign a specially crafted certificate, an attacker could bypass the check that non-CA certificates must not be able to issue other certificates and override the default purpose.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-3450?
CVE-2021-3450 is classified as critical due to its potential to allow remote attackers to bypass security restrictions.
How do I fix CVE-2021-3450?
To fix CVE-2021-3450, update OpenSSL to version 1.1.1k or higher, or apply patches provided by software vendors utilizing the affected libraries.
What systems are affected by CVE-2021-3450?
CVE-2021-3450 affects various versions of OpenSSL prior to 1.1.1k, and systems including IBM Security Verify Bridge and multiple embedded Linux distributions.
What type of vulnerability is CVE-2021-3450?
CVE-2021-3450 is an authentication bypass vulnerability that stems from a missing check in the validation logic of X.509 certificate chains.
Can CVE-2021-3450 be exploited remotely?
Yes, CVE-2021-3450 can be exploited remotely by attackers who manage to sign a specially crafted certificate.