CVE-2021-3449 | NULL pointer deref in signature_algorithms processing

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).

Published: 2021-03-25 Last update: 2024-11-21 Assigner: [email protected] Source: [email protected]

Conclusion & alert: CVE-2021-3449 is rated Moderate Risk (57.6/100): CVSS Medium severity, with high exploitation likelihood (EPSS 9.86%, 93th percentile). Core evidence: EPSS ranks this CVE among the most likely to be exploited in the near term. EPSS rose +1.50% over the last day, indicating growing attacker interest. Mandatory action: High exploitation likelihood—assess exposure and prioritize remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2021-3449

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-04-11 8.36% 9.86% +1.50%
2 2026-03-08 9.58% 8.36% -1.21%
3 2026-03-04 9.58%

Full EPSS history (81 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2021-3449

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
5.9 3.1 MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:H)
Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
2.2 3.6 [email protected]
4.3 2.0 MEDIUM
AV:N/AC:M/Au:N/C:N/I:N/A:P Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:N)
No confidentiality impact.
Integrity impact (I:N)
No integrity impact.
Availability impact (A:P)
Partial availability impact.
8.6 2.9 [email protected]

Weakness enumeration for CVE-2021-3449

GitHub Security Advisory for CVE-2021-3449

GHSA-83mx-573x-5rw9 · Severity: medium · Ecosystem: rust — openssl-src NULL pointer Dereference in signature_algorithms processing

OS Trackers for CVE-2021-3449

vendor priority summary link
alpine medium CVE-2021-3449: 4 source package rows (openssl, openssl1.1-compat, openssl3, synapse); 57 state rows across 17 repos (3.10-main, 3.11-main, 3.12-main, 3.17-community, 3.17-main, 3.18-community, 3.18-main, 3.19-community, 3.19-main, 3.20-community, 3.20-main, 3.21-community, 3.21-main, 3.22-community, 3.22-main, edge-community, edge-main); fixed 22, open 35. https://security.alpinelinux.org/vuln/CVE-2021-3449
debian not yet assigned CVE-2021-3449 not yet assigned priority: Debian including 1 source packages (openssl), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2021-3449
gentoo normal CVE-2021-3449: 1 GLSA(s) (202103-03), 1 atom(s) (dev-libs/openssl); latest impact normal. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2021-3449
redhat high https://access.redhat.com/security/cve/CVE-2021-3449
suse high CVE-2021-3449 severity important: SUSE including 524 source package names (0.21.0.3.2.10:libopenssl1_1-1.1.1d-11.20.1, 0.21.0.3.2.10:libopenssl1_1-hmac-1.1.1d-11.20.1, …), 1062 product×package rows across 201 product lines (Container bci/bci-init, Container bci/dotnet-aspnet, … (201 product lines)): Fixed 627, Known Not Affected 294, Known Affected 141. https://www.suse.com/security/cve/CVE-2021-3449/
ubuntu high CVE-2021-3449 high priority: Ubuntu including 10 source packages (edk2, nodejs, …), 154 status rows across 16 suites (bionic, focal, groovy, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): DNE 93, not-affected 34, released 17, needs-triage 5, ignored 4, deferred 1. https://ubuntu.com/security/CVE-2021-3449

Affected software / configurations for CVE-2021-3449

Vendor Product Version Raw CPE
openssl openssl >= 1.1.1, < 1.1.1k cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
debian debian_linux 9.0 cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
debian debian_linux 10.0 cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
freebsd freebsd 12.2 cpe:2.3:o:freebsd:freebsd:12.2:-:*:*:*:*:*:*
freebsd freebsd 12.2 cpe:2.3:o:freebsd:freebsd:12.2:p1:*:*:*:*:*:*
freebsd freebsd 12.2 cpe:2.3:o:freebsd:freebsd:12.2:p2:*:*:*:*:*:*
netapp active_iq_unified_manager cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
netapp cloud_volumes_ontap_mediator cpe:2.3:a:netapp:cloud_volumes_ontap_mediator:-:*:*:*:*:*:*:*
netapp e-series_performance_analyzer cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*
netapp oncommand_insight cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
netapp oncommand_workflow_automation cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
netapp ontap_select_deploy_administration_utility cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
netapp santricity_smi-s_provider cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:*
netapp snapcenter cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
netapp storagegrid cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*
tenable log_correlation_engine < 6.0.9 cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:*
tenable nessus <= 8.13.1 cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*
tenable nessus_network_monitor 5.11.0 cpe:2.3:a:tenable:nessus_network_monitor:5.11.0:*:*:*:*:*:*:*
tenable nessus_network_monitor 5.11.1 cpe:2.3:a:tenable:nessus_network_monitor:5.11.1:*:*:*:*:*:*:*
tenable nessus_network_monitor 5.12.0 cpe:2.3:a:tenable:nessus_network_monitor:5.12.0:*:*:*:*:*:*:*
tenable nessus_network_monitor 5.12.1 cpe:2.3:a:tenable:nessus_network_monitor:5.12.1:*:*:*:*:*:*:*
tenable nessus_network_monitor 5.13.0 cpe:2.3:a:tenable:nessus_network_monitor:5.13.0:*:*:*:*:*:*:*
tenable tenable.sc >= 5.13.0, <= 5.17.0 cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*
fedoraproject fedora 34 cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
mcafee web_gateway 8.2.19 cpe:2.3:a:mcafee:web_gateway:8.2.19:*:*:*:*:*:*:*
mcafee web_gateway 9.2.10 cpe:2.3:a:mcafee:web_gateway:9.2.10:*:*:*:*:*:*:*
mcafee web_gateway 10.1.1 cpe:2.3:a:mcafee:web_gateway:10.1.1:*:*:*:*:*:*:*
mcafee web_gateway_cloud_service 8.2.19 cpe:2.3:a:mcafee:web_gateway_cloud_service:8.2.19:*:*:*:*:*:*:*
mcafee web_gateway_cloud_service 9.2.10 cpe:2.3:a:mcafee:web_gateway_cloud_service:9.2.10:*:*:*:*:*:*:*
mcafee web_gateway_cloud_service 10.1.1 cpe:2.3:a:mcafee:web_gateway_cloud_service:10.1.1:*:*:*:*:*:*:*
checkpoint quantum_security_management_firmware r80.40 cpe:2.3:o:checkpoint:quantum_security_management_firmware:r80.40:*:*:*:*:*:*:*
checkpoint quantum_security_management_firmware r81 cpe:2.3:o:checkpoint:quantum_security_management_firmware:r81:*:*:*:*:*:*:*
checkpoint multi-domain_management_firmware r80.40 cpe:2.3:o:checkpoint:multi-domain_management_firmware:r80.40:*:*:*:*:*:*:*
checkpoint multi-domain_management_firmware r81 cpe:2.3:o:checkpoint:multi-domain_management_firmware:r81:*:*:*:*:*:*:*
checkpoint quantum_security_gateway_firmware r80.40 cpe:2.3:o:checkpoint:quantum_security_gateway_firmware:r80.40:*:*:*:*:*:*:*
checkpoint quantum_security_gateway_firmware r81 cpe:2.3:o:checkpoint:quantum_security_gateway_firmware:r81:*:*:*:*:*:*:*
oracle communications_communications_policy_management 12.6.0.0.0 cpe:2.3:a:oracle:communications_communications_policy_management:12.6.0.0.0:*:*:*:*:*:*:*
oracle enterprise_manager_for_storage_management 13.4.0.0 cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.4.0.0:*:*:*:*:*:*:*
oracle essbase 21.2 cpe:2.3:a:oracle:essbase:21.2:*:*:*:*:*:*:*
oracle graalvm 19.3.5 cpe:2.3:a:oracle:graalvm:19.3.5:*:*:*:enterprise:*:*:*
oracle graalvm 20.3.1.2 cpe:2.3:a:oracle:graalvm:20.3.1.2:*:*:*:enterprise:*:*:*
oracle graalvm 21.0.0.2 cpe:2.3:a:oracle:graalvm:21.0.0.2:*:*:*:enterprise:*:*:*
oracle jd_edwards_enterpriseone_tools < 9.2.6.0 cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
oracle jd_edwards_world_security a9.4 cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:*
oracle mysql_connectors <= 8.0.23 cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:*
oracle mysql_server <= 5.7.33 cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
oracle mysql_server >= 8.0.15, <= 8.0.23 cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
oracle mysql_workbench <= 8.0.23 cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*
oracle peoplesoft_enterprise_peopletools 8.57 cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*
oracle peoplesoft_enterprise_peopletools 8.58 cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
oracle peoplesoft_enterprise_peopletools 8.59 cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
oracle primavera_unifier >= 17.7, <= 17.12 cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*
oracle primavera_unifier 19.12 cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*
oracle primavera_unifier 20.12 cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*
oracle primavera_unifier 21.12 cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:*
oracle secure_backup < 18.1.0.1.0 cpe:2.3:a:oracle:secure_backup:*:*:*:*:*:*:*:*
oracle secure_global_desktop 5.6 cpe:2.3:a:oracle:secure_global_desktop:5.6:*:*:*:*:*:*:*
oracle zfs_storage_appliance_kit 8.8 cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*
sonicwall sma100_firmware >= 10.2.0.0, < 10.2.1.0-17sv cpe:2.3:o:sonicwall:sma100_firmware:*:*:*:*:*:*:*:*
sonicwall capture_client 3.5 cpe:2.3:a:sonicwall:capture_client:3.5:*:*:*:*:*:*:*
sonicwall sonicos 7.0.1.0 cpe:2.3:o:sonicwall:sonicos:7.0.1.0:*:*:*:*:*:*:*
siemens ruggedcom_rcm1224_firmware >= 6.2 cpe:2.3:o:siemens:ruggedcom_rcm1224_firmware:*:*:*:*:*:*:*:*
siemens scalance_lpe9403_firmware cpe:2.3:o:siemens:scalance_lpe9403_firmware:*:*:*:*:*:*:*:*
siemens scalance_m-800_firmware >= 6.2 cpe:2.3:o:siemens:scalance_m-800_firmware:*:*:*:*:*:*:*:*
siemens scalance_s602_firmware >= 4.1 cpe:2.3:o:siemens:scalance_s602_firmware:*:*:*:*:*:*:*:*
siemens scalance_s612_firmware >= 4.1 cpe:2.3:o:siemens:scalance_s612_firmware:*:*:*:*:*:*:*:*
siemens scalance_s615_firmware >= 6.2 cpe:2.3:o:siemens:scalance_s615_firmware:*:*:*:*:*:*:*:*
siemens scalance_s623_firmware >= 4.1 cpe:2.3:o:siemens:scalance_s623_firmware:*:*:*:*:*:*:*:*
siemens scalance_s627-2m_firmware >= 4.1 cpe:2.3:o:siemens:scalance_s627-2m_firmware:*:*:*:*:*:*:*:*
siemens scalance_sc-600_firmware >= 2.0 cpe:2.3:o:siemens:scalance_sc-600_firmware:*:*:*:*:*:*:*:*
siemens scalance_w700_firmware >= 6.5 cpe:2.3:o:siemens:scalance_w700_firmware:*:*:*:*:*:*:*:*
siemens scalance_w1700_firmware >= 2.0 cpe:2.3:o:siemens:scalance_w1700_firmware:*:*:*:*:*:*:*:*
siemens scalance_xb-200_firmware < 4.3 cpe:2.3:o:siemens:scalance_xb-200_firmware:*:*:*:*:*:*:*:*
siemens scalance_xc-200_firmware < 4.3 cpe:2.3:o:siemens:scalance_xc-200_firmware:*:*:*:*:*:*:*:*
siemens scalance_xf-200ba_firmware < 4.3 cpe:2.3:o:siemens:scalance_xf-200ba_firmware:*:*:*:*:*:*:*:*
siemens scalance_xm-400_firmware < 6.4 cpe:2.3:o:siemens:scalance_xm-400_firmware:*:*:*:*:*:*:*:*
siemens scalance_xp-200_firmware < 4.3 cpe:2.3:o:siemens:scalance_xp-200_firmware:*:*:*:*:*:*:*:*
siemens scalance_xr-300wg_firmware < 4.3 cpe:2.3:o:siemens:scalance_xr-300wg_firmware:*:*:*:*:*:*:*:*
siemens scalance_xr524-8c_firmware < 6.4 cpe:2.3:o:siemens:scalance_xr524-8c_firmware:*:*:*:*:*:*:*:*
siemens scalance_xr526-8c_firmware < 6.4 cpe:2.3:o:siemens:scalance_xr526-8c_firmware:*:*:*:*:*:*:*:*

References for CVE-2021-3449

URL Tags
http://www.openwall.com/lists/oss-security/2021/03/27/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/03/27/2 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/03/28/3 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/03/28/4 Mailing List Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf Patch Third Party Advisory
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fb9fa6b51defd48157eeb207f52181f735d96148
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845 Third Party Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10356 Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/08/msg00029.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013 Third Party Advisory
https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc Third Party Advisory
https://security.gentoo.org/glsa/202103-03 Third Party Advisory
https://security.netapp.com/advisory/ntap-20210326-0006/ Third Party Advisory
https://security.netapp.com/advisory/ntap-20210513-0002/ Third Party Advisory
https://security.netapp.com/advisory/ntap-20240621-0006/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd Third Party Advisory
https://www.debian.org/security/2021/dsa-4875 Third Party Advisory
https://www.openssl.org/news/secadv/20210325.txt Vendor Advisory
https://www.oracle.com//security-alerts/cpujul2021.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Third Party Advisory
https://www.tenable.com/security/tns-2021-05 Third Party Advisory
https://www.tenable.com/security/tns-2021-06 Third Party Advisory
https://www.tenable.com/security/tns-2021-09 Third Party Advisory
https://www.tenable.com/security/tns-2021-10 Third Party Advisory
cvelogic Threat Intelligence