Vulnerability in Openssl
CVE-2021-4160
There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are consi…
EPSS: 0.038 (88.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Openssl — versions Fixed in OpenSSL 1.1.1m (Affected 1.1.1-1.1.1l), Fixed in OpenSSL 3.0.1 (Affected 3.0.0), 3.0.0
- Oracle Enterprise_manager_ops_center — versions 12.4.0.0
- Oracle Health_sciences_inform_publisher — versions 6.2.1.1, 6.3.1.1
- Oracle Jd_edwards_enterpriseone_tools — versions 9.2.6.3
- Oracle Jd_edwards_world_security — versions a9.4
- Oracle Peoplesoft_enterprise_peopletools — versions 8.58, 8.59
- Siemens Sinec_ins — versions 1.0
- Debian Debian_linux — versions 9.0, 10.0, 11.0
Public proof-of-concept exploits
References
- openssl-security@openssl.org (Vendor Advisory)
- openssl-security@openssl.org
- openssl-security@openssl.org
- openssl-security@openssl.org
- openssl-security@openssl.org (vendor-advisory, Third Party Advisory)
- openssl-security@openssl.org (Patch, Third Party Advisory)
- openssl-security@openssl.org (Third Party Advisory)
- openssl-security@openssl.org (Third Party Advisory)
- openssl-security@openssl.org (vendor-advisory, Third Party Advisory)
- openssl-security@openssl.org
Frequently asked questions
- What is CVE-2021-4160?
- CVE-2021-4160 is a medium-severity vulnerability in Openssl. CVSS score: 5.9/10. Published 2022-01-28.
- How severe is CVE-2021-4160?
- Medium severity. CVSS v3 base score is 5.9 out of 10.
- Is CVE-2021-4160 known to be exploited?
- 10 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.