{"id":"RUSTSEC-2021-0055","revision":"63890a1c729a44ee9d58f1f98e128230","records":[{"revision":"63890a1c729a44ee9d58f1f98e128230","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2021-0055","aliases":["BIT-node-2021-3449","BIT-node-min-2021-3449","CVE-2021-3449","GHSA-83mx-573x-5rw9"],"title":"NULL pointer deref in signature_algorithms processing","description":"An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation\nClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits\nthe signature_algorithms extension (where it was present in the initial\nClientHello), but includes a signature_algorithms_cert extension then a NULL\npointer dereference will result, leading to a crash and a denial of service\nattack.\n\nA server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which\nis the default configuration). OpenSSL TLS clients are not impacted by this\nissue.","state":0,"publishedAt":"2021-05-01T12:00:00+00:00","modifiedAt":"2024-12-16T15:27:00.55712+00:00","affected":[{"ecosystem":"crates.io","name":"openssl-src","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"111.15.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null}],"references":["https://crates.io/crates/openssl-src","https://rustsec.org/advisories/RUSTSEC-2021-0055.html","https://www.openssl.org/news/secadv/20210325.txt"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2021-0055","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2021-0055","identifiers":["RUSTSEC-2021-0055","BIT-node-2021-3449","BIT-node-min-2021-3449","CVE-2021-3449","GHSA-83mx-573x-5rw9"]},"retained":false,"historicalAffected":[]}],"coverage":[]}