CVE-2021-3450

A flaw was found in openssl. The flag that enables additional security checks of certificates present in a certificate chain was not enabled allowing a confirmation step to verify that certificates in the chain are valid CA certificates is bypassed. The highest threat from this vulnerability is to data confidentiality and integrity.

This flaw affects openssl 1.1.1h and above only, older versions are not affected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The following conditions have to be met for an application compiled with OpenSSL to be vulnerable:

• the CA trusted by the system must issue or have issued certificates that don't include basic Key Usage extension.
• the CA certificates must not have path length constraint set to a value that would limit the certificate chain to just the subscriber certificates (i.e. CA certificate just above the subscriber cert must not have 0 as the path length constraint, and any CA above it must not have it increase by more than 1 for every level in the hierarchy)
• the attacker needs to have access to such subscriber certificate (without basic Key Usage and linking up to CAs without path length constraints or not effectively constraining certs issued by this certificate)
• the application under attack must use the X509_V_FLAG_X509_STRICT flag and must not set purpose for the certificate verification

if any of the above conditions are not met then the application compiled with OpenSSL is not vulnerable to the CVE.