CVE-2021-41581 - log back

CVE-2021-41581 edited at 08 Oct 2021 16:26:36
Description
- x509_constraints_parse_mailbox in lib/libcrypto/x509/x509_constraints.c in LibreSSL through 3.4.0 has a stack-based buffer over-read. When the input exceeds DOMAIN_PART_MAX_LEN, the buffer lacks '\0' termination.
+ x509_constraints_parse_mailbox in lib/libcrypto/x509/x509_constraints.c in LibreSSL before version 3.3.5 has a stack-based buffer over-read. When the input exceeds DOMAIN_PART_MAX_LEN, the buffer lacks '\0' termination.
References
https://github.com/libressl-portable/openbsd/issues/126
- https://github.com/openbsd/src/commit/62ceddea5b1d64a1a362bbb7071d9e15adcde6b1
+ https://github.com/libressl-portable/openbsd/commit/c45424a9d7ec9390195d651ab9344bc8ecba3401
CVE-2021-41581 edited at 24 Sep 2021 08:33:38
Severity
- Unknown
+ Medium
Remote
- Unknown
+ Remote
Type
- Unknown
+ Information disclosure
Description
+ x509_constraints_parse_mailbox in lib/libcrypto/x509/x509_constraints.c in LibreSSL through 3.4.0 has a stack-based buffer over-read. When the input exceeds DOMAIN_PART_MAX_LEN, the buffer lacks '\0' termination.
References
+ https://github.com/libressl-portable/openbsd/issues/126
+ https://github.com/openbsd/src/commit/62ceddea5b1d64a1a362bbb7071d9e15adcde6b1
Notes
CVE-2021-41581 created at 24 Sep 2021 08:32:41