CVE-2021-3450: CA certificate check bypass with X509_V_FLAG_X509_STRICT

Modified

AliasesALPINE-CVE-2021-3450UBUNTU-CVE-2021-3450DEBIAN-CVE-2021-3450+4 more

Published 25-03-2021Last modified 08-10-2026

Vulnerability summary

CVE-2021-3450 is a high (CVSS 7.4) Improper Certificate Validation vulnerability in fedoraproject fedora. EPSS estimates a 18.34% chance of exploitation in the next 30 days, higher than 97.2% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.4 (NVD); no exploitation reported by the 5 checked sources; EPSS 18% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.4/10

010

High · v3.1 (NVD)

EPSS score

18.34%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 15 · Related 9

MGASA-2021-0176 OPENSUSE-SU-2021:1059-1 OPENSUSE-SU-2021:1061-1 OPENSUSE-SU-2021:2327-1 OPENSUSE-SU-2021:2353-1 OPENSUSE-SU-2024:11127-1+9 more

Timeline

25-03-2021
PublishedVulnerability first disclosed.
08-10-2026
Last modifiedVulnerability information updated.

Description

The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a "purpose" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named "purpose" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j).

CVSS metrics

6 scores · 5 sources · 2 versions

v3.17.4v2.05.8

EPSS trend

Probability

18.34%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

No change 0.00 pp

From 18.34% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Oracle13 products

commerce_guided_search11.3.2
enterprise_manager_for_storage_management13.4.0.0
graalvmEOL19.3.5 | 20.3.1.2 | 21.0.0.2
jd_edwards_enterpriseone_tools< 9.2.6.0
jd_edwards_world_securitya9.4

Show all 13

Netapp5 products

Sonicwall4 products

capture_client< 3.6.24
email_security< 10.0.11
sma100_firmware< 10.2.1.0-17sv
sonicos≤ 7.0.1-r1456

Alpine3 products

openssl≥ 1.1.1h, < 1.1.1k-r0
openssl1.1-compat< 1.1.1k-r0
openssl3< 1.1.1k-r0

Tenable3 products

nessus≤ 8.13.1
nessus_agent≥ 8.2.1, ≤ 8.2.3
nessus_network_monitor5.11.0 | 5.11.1 | 5.12.0 | 5.12.1 | 5.13.0

Mcafee2 products

web_gateway8.2.19 | 9.2.10 | 10.1.1
web_gateway_cloud_service8.2.19 | 9.2.10 | 10.1.1

Ubuntu2 products

openssl< 1.0.2g-1ubuntu4.19 | < 1.1.1-1ubuntu2.1~18.04.8 | < 1.1.1f-1ubuntu2.2
openssl1.0< 1.0.2n-1ubuntu5.6

Crates.Io1 product

openssl-src≥ 111.11.0, < 111.15.0

Debian1 product

openssl< 1.1.1k-1

Fedoraproject1 product

fedoraEOL34

Freebsd1 product

freebsdEOL12.2 | 12.2:p1 | 12.2:p2

Nodejs1 product

node.js≥ 10.0.0, < 10.24.1 | ≥ 12.0.0, < 12.22.1 | ≥ 14.0.0, < 14.16.1 | ≥ 15.0.0, < 15.14.0

Openssl1 product

opensslFixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j) | ≥ 1.1.1h, < 1.1.1k

Windriver1 product

linuxna | 17.0 | 18.0 | 19.0

14 vendors · 39 products

References

35 links

www.openssl.org/news/secadv/20210325.txtX Refsource CONFIRMREPORTWEBVendor Advisory
git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2a40b7bc7b94dd7de897a74571e7024f0cf0d63bX Refsource CONFIRM
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJdVendor AdvisoryX Refsource CISCOWEBThird Party Advisory
www.openwall.com/lists/oss-security/2021/03/27/1Mailing ListX Refsource MLISTWEBThird Party Advisory
www.openwall.com/lists/oss-security/2021/03/27/2Mailing ListX Refsource MLISTWEBThird Party Advisory
www.openwall.com/lists/oss-security/2021/03/28/3Mailing ListX Refsource MLISTWEBThird Party Advisory
www.openwall.com/lists/oss-security/2021/03/28/4Mailing ListX Refsource MLISTWEBThird Party Advisory
security.gentoo.org/glsa/202103-03Vendor AdvisoryX Refsource GENTOOWEBThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
www.oracle.com/security-alerts/cpuApr2021.htmlX Refsource MISCWEBPatchThird Party Advisory

Show all 35 references

www.tenable.com/security/tns-2021-09X Refsource CONFIRMWEBThird Party Advisory
security.netapp.com/advisory/ntap-20210326-0006/X Refsource CONFIRMThird Party Advisory
security.freebsd.org/advisories/FreeBSD-SA-21:07.openssl.ascX Refsource MISCWEBThird Party Advisory
www.tenable.com/security/tns-2021-05X Refsource CONFIRMWEBThird Party Advisory
kc.mcafee.com/corporate/index?page=content&id=SB10356X Refsource CONFIRMWEBThird Party Advisory
www.tenable.com/security/tns-2021-08X Refsource CONFIRMWEBThird Party Advisory
mta.openssl.org/pipermail/openssl-announce/2021-March/000198.htmlX Refsource MISCWEBMailing ListVendor Advisory
www.oracle.com//security-alerts/cpujul2021.htmlX Refsource MISCWEBPatchThird Party Advisory
kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845X Refsource CONFIRMWEBThird Party Advisory
psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013X Refsource CONFIRMWEBThird Party Advisory
www.oracle.com/security-alerts/cpuoct2021.htmlX Refsource MISCWEBPatchThird Party Advisory
www.oracle.com/security-alerts/cpuapr2022.htmlX Refsource MISCWEBPatchThird Party Advisory
cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfX Refsource CONFIRMWEBThird Party Advisory
www.oracle.com/security-alerts/cpujul2022.htmlX Refsource MISCWEBPatchThird Party Advisory
security.alpinelinux.org/vuln/CVE-2021-3450Advisory
ubuntu.com/security/CVE-2021-3450REPORT
www.cve.org/CVERecord?id=CVE-2021-3450REPORT
security-tracker.debian.org/tracker/CVE-2021-3450Advisory
nvd.nist.gov/vuln/detail/CVE-2021-3450Advisory
security.netapp.com/advisory/ntap-20210326-0006WEB
rustsec.org/advisories/RUSTSEC-2021-0056.htmlWEBAdvisory
lists.fedoraproject.org/archives/…WEB
github.com/alexcrichton/openssl-src-rsPACKAGE
git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2a40b7bc7b94dd7de897a74571e7024f0cf0d63bWEB
crates.io/crates/openssl-srcPACKAGE