Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2021-3712

ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y).

CVSS 7.4 · HighBuzz score 24.4

Buzz score

Why this CVE is surfacing

Buzz score total 24.4

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 17.9 · diversity 6.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Mention score
17.9
5 evidence mentions in the snapshot
Diversity score
6.5
2 sources across 1 categories
KEV score
0.0
No KEV entry observed
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
5 source links · newest first
  • QNAP will patche OpenSSL flaws in its NAS devicesSecurity Affairs

    Network-attached storage (NAS) appliance maker QNAP is working on security patches for its products affected by recently fixed OpenSSL flaws. Taiwanese Network-attached storage (NAS) appliance maker QNAP announced that it is assessing the potential impact of two recently addressed flaws in OpenSSL on its products. The company also announced that it is working on security updates […]

    newssecurityaffairs.comSep 1, 2021, 6:36 PM
  • Companies Release Security Advisories in Response to New OpenSSL VulnerabilitiesSecurityWeek

    Companies that use OpenSSL in their products have started releasing security advisories to inform customers about the impact of two recently patched vulnerabilities. Updates announced by the OpenSSL Project on August 24 patched CVE-2021-3711, a high-severity buffer overflow related to SM2 decryption, and CVE-2021-3712, a medium-severity flaw that can be exploited for denial-of-service (DoS) attacks, and possibly for the disclosure of private memory contents. The high-severity vulnerability, patched with the release of OpenSSL 1.1.1l, can allow an attacker to change an application’s behavior or cause it to crash. The changes an attacker could make depend on the targeted app and the type of data it processes. Cybersecurity firm Sophos, which published an analysis of the two OpenSSL vulnerabilities , noted that an attacker could trick an application “into thinking that something succeeded (or failed) when it didn’t, or even to take over the flow of program execution entirely.” Several ma…

    newswww.securityweek.comAug 31, 2021, 10:44 AM
  • Some Synology products impacted by recently disclosed OpenSSL flawsSecurity Affairs

    Taiwan vendor Synology announced that recently disclosed vulnerabilities (CVE-2021-3711 and CVE-2021-3712) in the OpenSSL impact some of its products. Taiwanese company Synology revealed that the recently disclosed remote code execution (RCE) and denial-of-service (DoS) OpenSSL vulnerabilities (CVE-2021-3711 and CVE-2021-3712) impact some of its products. “Multiple vulnerabilities allow remote attackers to conduct denial-of-service attack or possibly execute arbitrary code via […]

    newssecurityaffairs.comAug 29, 2021, 7:01 AM
  • CVE-2021-3711 in OpenSSL can allow to change an application’s behaviorSecurity Affairs

    The OpenSSL Project patched a high-severity vulnerability, tracked as CVE-2021-3711, that can allow an attacker to change an application’s behavior or cause the app to crash. The OpenSSL Project released the OpenSSL 1.1.1l version that addresses a high-severity buffer overflow flaw, tracked as CVE-2021-3711, that could allow an attacker to change an application’s behavior or […]

    newssecurityaffairs.comAug 24, 2021, 9:43 PM
  • OpenSSL Vulnerability Can Be Exploited to Change Application DataSecurityWeek

    The OpenSSL Project on Tuesday announced the availability of OpenSSL 1.1.1l, which patches a high-severity vulnerability that could allow an attacker to change an application’s behavior or cause the app to crash. The flaw, tracked as CVE-2021-3711 , has been described as a buffer overflow related to SM2 decryption. “A malicious attacker who is able to present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated,” the OpenSSL Project said in an advisory. The OpenSSL Project’s Matt Caswell told SecurityWeek that the changes an attacker could make depend on the targeted application and the type of data it holds in the heap immediately after the overrun buffer. “Think of any kind of data that an…

    newswww.securityweek.comAug 24, 2021, 3:44 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence