ID

VAR-202103-1463

CVE

CVE-2021-3450

TITLE

Red Hat Security Advisory 2021-2130-01

DESCRIPTION

The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a "purpose" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named "purpose" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j). The product supports a variety of encryption algorithms, including symmetric ciphers, hash algorithms, secure hash algorithms, etc. Description: Windows Container Support for Red Hat OpenShift allows you to deploy Windows container workloads running on Windows Server containers. Bug Fix(es): * WMCO patch pub-key-hash annotation to Linux node (BZ#1945248) * LoadBalancer Service type with invalid external loadbalancer IP breaks the datapath (BZ#1952917) * Telemetry info not completely available to identify windows nodes (BZ#1955319) * WMCO incorrectly shows node as ready after a failed configuration (BZ#1956412) * kube-proxy service terminated unexpectedly after recreated LB service (BZ#1963263) 3. Solution: For Windows Machine Config Operator upgrades, see the following documentation: https://docs.openshift.com/container-platform/4.7/windows_containers/window s-node-upgrades.html 4. Bugs fixed (https://bugzilla.redhat.com/): 1945248 - WMCO patch pub-key-hash annotation to Linux node 1946538 - CVE-2021-25736 kubernetes: LoadBalancer Service type don't create a HNS policy for empty or invalid external loadbalancer IP, what could lead to MITM 1952917 - LoadBalancer Service type with invalid external loadbalancer IP breaks the datapath 1955319 - Telemetry info not completely available to identify windows nodes 1956412 - WMCO incorrectly shows node as ready after a failed configuration 1963263 - kube-proxy service terminated unexpectedly after recreated LB service 5. Bugs fixed (https://bugzilla.redhat.com/): 1897635 - CVE-2020-28362 golang: math/big: panic during recursive division of very large numbers 1918750 - CVE-2021-3114 golang: crypto/elliptic: incorrect operations on the P-224 curve 1928172 - CVE-2020-13949 libthrift: potential DoS when processing untrusted payloads 1928937 - CVE-2021-23337 nodejs-lodash: command injection via template 1928954 - CVE-2020-28500 nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions 5. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat Virtualization security, bug fix, and enhancement update Advisory ID: RHSA-2021:1189-01 Product: Red Hat Virtualization Advisory URL: https://access.redhat.com/errata/RHSA-2021:1189 Issue date: 2021-04-14 CVE Names: CVE-2021-3449 CVE-2021-3450 ===================================================================== 1. Summary: An update is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: RHEL 8-based RHEV-H for RHEV 4 (build requirements) - noarch, x86_64 Red Hat Virtualization 4 Hypervisor for RHEL 8 - noarch, x86_64 3. Description: The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. The ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. Changes to the redhat-release-virtualization-host component: * Previously, the redhat-support-tool was missing from the RHV-H 4.4 package. In this release, the redhat-support-tool has been added. (BZ#1928607) Security Fix(es): * openssl: NULL pointer dereference in signature_algorithms processing (CVE-2021-3449) * openssl: CA certificate check bypass with X509_V_FLAG_X509_STRICT (CVE-2021-3450) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/2974891 The system must be rebooted for this update to take effect. For the update to take effect, all services linked to the glibc library must be restarted, or the system rebooted. 5. Bugs fixed (https://bugzilla.redhat.com/): 1892573 - RHVH 4.4.2 fails to boot from SAN when using UUID for /boot partition 1895832 - RHVH 4.4.3: No response when clicking button "Help" in Anaconda GUI 1907306 - "sysstat" doesn't collect data for upgraded RHVH 1907358 - In FIPS mode, RHVH cannot enter the new layer after upgrade 1907746 - RHVH cannot enter the new layer after upgrade testing with STIG profile selected. 1918207 - RHVH upgrade to 4.4.5-1 will fail due to FileNotFoundError 1927395 - RHVH, protecting key packages from being removed. 1928607 - redhat-support-tool is missing from latest RHV-H 4.4 1940845 - Include updated gluster-ansible-features in RHV-H 4.4.5 1941547 - CVE-2021-3450 openssl: CA certificate check bypass with X509_V_FLAG_X509_STRICT 1941554 - CVE-2021-3449 openssl: NULL pointer dereference in signature_algorithms processing 1942040 - Rebase RHV-H 4.4.5 on RHEL-AV 8.3.1 Async 1942498 - Rebase RHV-H 4.4.5 on RHEL-8.3.1.3 6. Package List: Red Hat Virtualization 4 Hypervisor for RHEL 8: Source: boost-1.66.0-10.el8.src.rpm dyninst-10.1.0-4.el8.src.rpm gcc-8.3.1-5.1.el8.src.rpm isl-0.16.1-6.el8.src.rpm libmpc-1.0.2-9.el8.src.rpm libxcrypt-4.1.1-4.el8.src.rpm make-4.2.1-10.el8.src.rpm redhat-virtualization-host-4.4.5-20210330.0.el8_3.src.rpm tbb-2018.2-9.el8.src.rpm zip-3.0-23.el8.src.rpm noarch: redhat-virtualization-host-image-update-4.4.5-20210330.0.el8_3.noarch.rpm vim-filesystem-8.0.1763-15.el8.noarch.rpm x86_64: boost-atomic-debuginfo-1.66.0-10.el8.x86_64.rpm boost-chrono-debuginfo-1.66.0-10.el8.x86_64.rpm boost-container-debuginfo-1.66.0-10.el8.x86_64.rpm boost-context-debuginfo-1.66.0-10.el8.x86_64.rpm boost-coroutine-debuginfo-1.66.0-10.el8.x86_64.rpm boost-date-time-1.66.0-10.el8.x86_64.rpm boost-date-time-debuginfo-1.66.0-10.el8.x86_64.rpm boost-debuginfo-1.66.0-10.el8.x86_64.rpm boost-debugsource-1.66.0-10.el8.x86_64.rpm boost-doctools-debuginfo-1.66.0-10.el8.x86_64.rpm boost-fiber-debuginfo-1.66.0-10.el8.x86_64.rpm boost-filesystem-debuginfo-1.66.0-10.el8.x86_64.rpm boost-graph-debuginfo-1.66.0-10.el8.x86_64.rpm boost-graph-mpich-debuginfo-1.66.0-10.el8.x86_64.rpm boost-graph-openmpi-debuginfo-1.66.0-10.el8.x86_64.rpm boost-iostreams-debuginfo-1.66.0-10.el8.x86_64.rpm boost-locale-debuginfo-1.66.0-10.el8.x86_64.rpm boost-log-debuginfo-1.66.0-10.el8.x86_64.rpm boost-math-debuginfo-1.66.0-10.el8.x86_64.rpm boost-mpich-debuginfo-1.66.0-10.el8.x86_64.rpm boost-mpich-python3-debuginfo-1.66.0-10.el8.x86_64.rpm boost-numpy3-debuginfo-1.66.0-10.el8.x86_64.rpm boost-openmpi-debuginfo-1.66.0-10.el8.x86_64.rpm boost-openmpi-python3-debuginfo-1.66.0-10.el8.x86_64.rpm boost-program-options-debuginfo-1.66.0-10.el8.x86_64.rpm boost-python3-debuginfo-1.66.0-10.el8.x86_64.rpm boost-random-debuginfo-1.66.0-10.el8.x86_64.rpm boost-regex-debuginfo-1.66.0-10.el8.x86_64.rpm boost-serialization-debuginfo-1.66.0-10.el8.x86_64.rpm boost-signals-debuginfo-1.66.0-10.el8.x86_64.rpm boost-stacktrace-debuginfo-1.66.0-10.el8.x86_64.rpm boost-system-debuginfo-1.66.0-10.el8.x86_64.rpm boost-test-debuginfo-1.66.0-10.el8.x86_64.rpm boost-thread-debuginfo-1.66.0-10.el8.x86_64.rpm boost-timer-debuginfo-1.66.0-10.el8.x86_64.rpm boost-type_erasure-debuginfo-1.66.0-10.el8.x86_64.rpm boost-wave-debuginfo-1.66.0-10.el8.x86_64.rpm bpftool-debuginfo-4.18.0-240.22.1.el8_3.x86_64.rpm compat-libmpc-debuginfo-1.0.2-9.el8.x86_64.rpm cpp-8.3.1-5.1.el8.x86_64.rpm cpp-debuginfo-8.3.1-5.1.el8.x86_64.rpm dyninst-10.1.0-4.el8.x86_64.rpm dyninst-debuginfo-10.1.0-4.el8.x86_64.rpm dyninst-debugsource-10.1.0-4.el8.x86_64.rpm dyninst-devel-debuginfo-10.1.0-4.el8.x86_64.rpm dyninst-testsuite-debuginfo-10.1.0-4.el8.x86_64.rpm gcc-8.3.1-5.1.el8.x86_64.rpm gcc-c++-debuginfo-8.3.1-5.1.el8.x86_64.rpm gcc-debuginfo-8.3.1-5.1.el8.x86_64.rpm gcc-debugsource-8.3.1-5.1.el8.x86_64.rpm gcc-gdb-plugin-debuginfo-8.3.1-5.1.el8.x86_64.rpm gcc-gfortran-debuginfo-8.3.1-5.1.el8.x86_64.rpm gcc-offload-nvptx-debuginfo-8.3.1-5.1.el8.x86_64.rpm gcc-plugin-devel-debuginfo-8.3.1-5.1.el8.x86_64.rpm glibc-debuginfo-2.28-127.el8_3.2.x86_64.rpm glibc-debuginfo-common-2.28-127.el8_3.2.x86_64.rpm glibc-devel-2.28-127.el8_3.2.x86_64.rpm glibc-headers-2.28-127.el8_3.2.x86_64.rpm isl-0.16.1-6.el8.x86_64.rpm isl-debugsource-0.16.1-6.el8.x86_64.rpm kernel-debug-debuginfo-4.18.0-240.22.1.el8_3.x86_64.rpm kernel-debuginfo-4.18.0-240.22.1.el8_3.x86_64.rpm kernel-debuginfo-common-x86_64-4.18.0-240.22.1.el8_3.x86_64.rpm kernel-devel-4.18.0-240.22.1.el8_3.x86_64.rpm kernel-headers-4.18.0-240.22.1.el8_3.x86_64.rpm kernel-tools-debuginfo-4.18.0-240.22.1.el8_3.x86_64.rpm libasan-debuginfo-8.3.1-5.1.el8.x86_64.rpm libatomic-debuginfo-8.3.1-5.1.el8.x86_64.rpm libgcc-8.3.1-5.1.el8.x86_64.rpm libgcc-debuginfo-8.3.1-5.1.el8.x86_64.rpm libgfortran-debuginfo-8.3.1-5.1.el8.x86_64.rpm libgomp-8.3.1-5.1.el8.x86_64.rpm libgomp-debuginfo-8.3.1-5.1.el8.x86_64.rpm libgomp-offload-nvptx-debuginfo-8.3.1-5.1.el8.x86_64.rpm libitm-debuginfo-8.3.1-5.1.el8.x86_64.rpm liblsan-debuginfo-8.3.1-5.1.el8.x86_64.rpm libmpc-1.0.2-9.el8.x86_64.rpm libmpc-debuginfo-1.0.2-9.el8.x86_64.rpm libmpc-debugsource-1.0.2-9.el8.x86_64.rpm libquadmath-debuginfo-8.3.1-5.1.el8.x86_64.rpm libstdc++-debuginfo-8.3.1-5.1.el8.x86_64.rpm libtsan-debuginfo-8.3.1-5.1.el8.x86_64.rpm libubsan-debuginfo-8.3.1-5.1.el8.x86_64.rpm libxcrypt-debugsource-4.1.1-4.el8.x86_64.rpm libxcrypt-devel-4.1.1-4.el8.x86_64.rpm make-4.2.1-10.el8.x86_64.rpm make-debugsource-4.2.1-10.el8.x86_64.rpm perf-4.18.0-240.22.1.el8_3.x86_64.rpm perf-debuginfo-4.18.0-240.22.1.el8_3.x86_64.rpm python3-perf-debuginfo-4.18.0-240.22.1.el8_3.x86_64.rpm tbb-2018.2-9.el8.x86_64.rpm tbb-debugsource-2018.2-9.el8.x86_64.rpm vim-X11-debuginfo-8.0.1763-15.el8.x86_64.rpm vim-common-8.0.1763-15.el8.x86_64.rpm vim-common-debuginfo-8.0.1763-15.el8.x86_64.rpm vim-debuginfo-8.0.1763-15.el8.x86_64.rpm vim-debugsource-8.0.1763-15.el8.x86_64.rpm vim-enhanced-8.0.1763-15.el8.x86_64.rpm vim-enhanced-debuginfo-8.0.1763-15.el8.x86_64.rpm vim-minimal-debuginfo-8.0.1763-15.el8.x86_64.rpm zip-3.0-23.el8.x86_64.rpm zip-debugsource-3.0-23.el8.x86_64.rpm RHEL 8-based RHEV-H for RHEV 4 (build requirements): Source: imgbased-1.2.18-0.1.el8ev.src.rpm redhat-release-virtualization-host-4.4.5-4.el8ev.src.rpm scap-security-guide-0.1.50-1.el8ev.src.rpm noarch: imgbased-1.2.18-0.1.el8ev.noarch.rpm python3-imgbased-1.2.18-0.1.el8ev.noarch.rpm redhat-virtualization-host-image-update-placeholder-4.4.5-4.el8ev.noarch.rpm scap-security-guide-rhv-0.1.50-1.el8ev.noarch.rpm x86_64: redhat-release-virtualization-host-4.4.5-4.el8ev.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-3449 https://access.redhat.com/security/cve/CVE-2021-3450 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYHbW2dzjgjWX9erEAQhrvQ//VGyhTZ32NVUTnNMVVaHZyN5HL2Gt7CRG sOA8Z7hKGGPq8nHZEeTtk2KBpxaLLzVHxKmILtnsRTlRqq2s4BSgd9j7YhNvTlZe kK6Y3ovcWBKdqqui2ezZz9WFmKbQ5yjJImMo+TfyAS0D1RLwxNyKzDyYDCIZuO03 1AcV0ILWSVpaEKRrjOX6S0VnmMR0hqf4JmgLk8/ePv3wp+vd5voeIymWDPy6KrPW 0WS6NLHHNGucnzKXiRglwLeWKCYdQ+MCewkLKch/4eQPI28+N72dEgI9nhbZMind khmKrnPDt5CIS9aWNmm+B/pWHZB1kEFt6hls/+xn2aXvrHxGgj6aTyl1peMhxYwA bvlQx+p1jOOREgtvnQHwemAVEuZByW4QFWqdZn/BIqbImTjxlawqYRwHjWpOvMfo Z6l7kiG86TsEWj/QJGAoRvwmqer7pWrttVeUivFBNmUhgZ8lEIMT3MkULY8VBJp+ PrwbQwfpMn38PZbnl/DT3A0aSgZ1Q1uQZooW8B6zBKYUdgwTU8impaBaKfyM9QRq hCqHX42S4b/tNZhy64hlfkv24kei4RqgI4sGVeDfSA/tWzdgvBghQ1pOEhlPY4MH jINgKocRD1f08X0meBmqk4IuoZdWkUrGgvprmT81At4ZF3omaQ1amKj1HhXpmJVa da5fQnRzZzc= =xbcY -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . Bugs fixed (https://bugzilla.redhat.com/): 1918750 - CVE-2021-3114 golang: crypto/elliptic: incorrect operations on the P-224 curve 1918761 - CVE-2021-3115 golang: cmd/go: packages using cgo can cause arbitrary code execution at build time 1935897 - Release of OpenShift Serverless Serving 1.14.0 1935898 - Release of OpenShift Serverless Eventing 1.14.0 5. 8) - aarch64, ppc64le, s390x, x86_64 3. Description: OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Summary: Red Hat JBoss Core Services Pack Apache Server 2.4.37 Service Pack 7 zip release for RHEL 7, RHEL 8 and Microsoft Windows is available. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience. This release adds the new Apache HTTP Server 2.4.37 Service Pack 7 packages that are part of the JBoss Core Services offering. This release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.37 Service Pack 6 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link for the update. You must be logged in to download the update. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

TYPE

code execution

EXTERNAL IDS

REFERENCES

CREDITS

Red Hat

SOURCES

LAST UPDATE DATE

2026-03-24T21:46:41.102000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE