UpHeron
All vulnerabilities

Servers and applications

CVE-2021-3449

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server…

Severity
Medium 5.9
Published
25 Mar 2021
Last changed
8 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
1.1.1k, 12.22.1, 14.16.1, 15.14.0
Sources
NVD

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 15.0.0 before 15.14.0
  • From 14.15.0 before 14.16.1
  • From 14.0.0 up to 14.14.0
  • From 12.13.0 before 12.22.1
All 7 release lines
  • From 10.0.0 up to 10.12.0
  • From 10.13.0 up to 10.24.0
  • From 12.0.0 up to 12.12.0
  • From 12.13.0 before 12.22.1
  • From 14.0.0 up to 14.14.0
  • From 14.15.0 before 14.16.1
  • From 15.0.0 before 15.14.0
OpenSSLServers and applications · cpe:a:openssl:openssl
  • From 1.1.1 before 1.1.1k
MySQLServers and applications · cpe:a:oracle:mysql_server
  • Every version up to 5.7.33
  • From 8.0.15 up to 8.0.23

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-3449
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-3449