CVE-2021-41581 Memory corruption in n/a

Medium 5.5 Published 24 Sep 2021 Updated 4 Aug 2024

A stack-based buffer over-read in LibreSSL's X.509 constraint parser can cause crashes or leak memory when processing malformed inputs.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2021-41581?

CVE-2021-41581 is a medium-severity memory corruption vulnerability in n/a, published on 24 Sep 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

x509_constraints_parse_mailbox in lib/libcrypto/x509/x509_constraints.c in LibreSSL through 3.4.0 has a stack-based buffer over-read. When the input exceeds DOMAIN_PART_MAX_LEN, the buffer lacks '\0' termination.

Weakness: CWE-125

Which versions are affected by CVE-2021-41581?

It affects 1 product.

Products include Openbsd Libressl.

How do I fix CVE-2021-41581?

No fix has been published for CVE-2021-41581 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2021-41581 being exploited?

There is no known exploitation of CVE-2021-41581 in the wild and no public exploit code.

Sources

Also known as GHSA-675w-hmxx-cvf3.