ALAS2-2021-1721 --- opensslID: oval:org.secpod.oval:def:1700731 | Date: (C)2021-11-11 (M)2023-11-13 |
Class: PATCH | Family: unix |
It was found that openssl assumed ASN.1 strings to be NUL terminated. A malicious actor may be able to force an application into calling openssl function with a specially crafted, non-NUL terminated string to deliberately hit this bug, which may result in a crash of the application, causing a Denial of Service attack, or possibly, memory disclosure. The highest threat from this vulnerability is to data confidentiality and system availability