CVE-2021-3712

It was found that openssl assumed ASN.1 strings to be NUL terminated. A malicious actor may be able to force an application into calling openssl function with a specially crafted, non-NUL terminated string to deliberately hit this bug, which may result in a crash of the application, causing a Denial of Service attack, or possibly, memory disclosure. The highest threat from this vulnerability is to data confidentiality and system availability.

The following Red Hat products do not ship the affected OpenSSL component but rely on the Red Hat Enterprise Linux to consume them:

• Red Hat Satellite
• Red Hat Update Infrastructure
• Red Hat CloudForms

The Red Hat Advanced Cluster Management for Kubernetes is using the vulnerable version of the library, however the vulnerable code path is not reachable.

compat-openssl10 is deprecated and has been removed from RHEL 9 and later. No further patches would be available for this component except on a case by case basis.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Customers should make an attempt to run current binaries/architectures and not rely on compatibility layers to run older binaries/architectures. In case older binaries/architectures are needed, sandboxing should be used to address such problems and guard the bug.