CVE-2021-4160
- Source
- https://cve.org/CVERecord?id=CVE-2021-4160
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-4160.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2021-4160
- Downstream
AZL (1)
BELL (1)
DEBIAN (1)
ECHO (1)
JLSEC (1)
UBUNTU (1)
- Published
- 2022-01-28T22:15:15Z
- Modified
- 2026-11-11T13:22:02Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH private key among multiple clients, which is no longer an option since CVE-2016-0701. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0.0. It was addressed in the releases of 1.1.1m and 3.0.1 on the 15th of December 2021. For the 1.0.2 release it is addressed in git commit 6fc1aaaf3 that is available to premium support customers only. It will be made available in 1.0.2zc when it is released. The issue only affects OpenSSL on MIPS platforms. Fixed in OpenSSL 3.0.1 (Affected 3.0.0). Fixed in OpenSSL 1.1.1m (Affected 1.1.1-1.1.1l). Fixed in OpenSSL 1.0.2zc-dev (Affected 1.0.2-1.0.2zb).
- Database specific
{ "unresolved_ranges": [ { "cpes": [ "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "1.0.2" }, { "last_affected": "1.0.2zb" }, { "introduced": "1.1.1" }, { "fixed": "1.1.1m" } ], "source": "CPE_RANGE" } ], "vendor_product": "openssl:openssl" }, { "cpes": [ "cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "fixed": "1.0" } ], "source": "CPE_RANGE" } ], "vendor_product": "siemens:sinec_ins" }, { "cpes": [ "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "9.0" }, { "last_affected": "9.0" }, { "introduced": "10.0" }, { "last_affected": "10.0" }, { "introduced": "11.0" }, { "last_affected": "11.0" } ], "source": "CPE_STRING" } ], "vendor_product": "debian:debian_linux" }, { "cpes": [ "cpe:2.3:a:openssl:openssl:3.0.0:-:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:3.0.0:alpha10:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:3.0.0:alpha11:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:3.0.0:alpha12:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:3.0.0:alpha13:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:3.0.0:alpha14:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:3.0.0:alpha15:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:3.0.0:alpha16:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:3.0.0:alpha17:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:3.0.0:alpha1:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:3.0.0:alpha2:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:3.0.0:alpha3:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:3.0.0:alpha4:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:3.0.0:alpha5:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:3.0.0:alpha6:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:3.0.0:alpha7:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:3.0.0:alpha8:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:3.0.0:alpha9:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:3.0.0:beta1:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:3.0.0:beta2:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "3.0.0-NA" }, { "last_affected": "3.0.0-NA" }, { "introduced": "3.0.0-NA" }, { "last_affected": "3.0.0-NA" }, { "introduced": "3.0.0-alpha1" }, { "last_affected": "3.0.0-alpha1" }, { "introduced": "3.0.0-alpha1" }, { "last_affected": "3.0.0-alpha1" }, { "introduced": "3.0.0-alpha10" }, { "last_affected": "3.0.0-alpha10" }, { "introduced": "3.0.0-alpha10" }, { "last_affected": "3.0.0-alpha10" }, { "introduced": "3.0.0-alpha11" }, { "last_affected": "3.0.0-alpha11" }, { "introduced": "3.0.0-alpha11" }, { "last_affected": "3.0.0-alpha11" }, { "introduced": "3.0.0-alpha12" }, { "last_affected": "3.0.0-alpha12" }, { "introduced": "3.0.0-alpha12" }, { "last_affected": "3.0.0-alpha12" }, { "introduced": "3.0.0-alpha13" }, { "last_affected": "3.0.0-alpha13" }, { "introduced": "3.0.0-alpha13" }, { "last_affected": "3.0.0-alpha13" }, { "introduced": "3.0.0-alpha14" }, { "last_affected": "3.0.0-alpha14" }, { "introduced": "3.0.0-alpha14" }, { "last_affected": "3.0.0-alpha14" }, { "introduced": "3.0.0-alpha15" }, { "last_affected": "3.0.0-alpha15" }, { "introduced": "3.0.0-alpha15" }, { "last_affected": "3.0.0-alpha15" }, { "introduced": "3.0.0-alpha16" }, { "last_affected": "3.0.0-alpha16" }, { "introduced": "3.0.0-alpha16" }, { "last_affected": "3.0.0-alpha16" }, { "introduced": "3.0.0-alpha17" }, { "last_affected": "3.0.0-alpha17" }, { "introduced": "3.0.0-alpha17" }, { "last_affected": "3.0.0-alpha17" }, { "introduced": "3.0.0-alpha2" }, { "last_affected": "3.0.0-alpha2" }, { "introduced": "3.0.0-alpha2" }, { "last_affected": "3.0.0-alpha2" }, { "introduced": "3.0.0-alpha3" }, { "last_affected": "3.0.0-alpha3" }, { "introduced": "3.0.0-alpha3" }, { "last_affected": "3.0.0-alpha3" }, { "introduced": "3.0.0-alpha4" }, { "last_affected": "3.0.0-alpha4" }, { "introduced": "3.0.0-alpha4" }, { "last_affected": "3.0.0-alpha4" }, { "introduced": "3.0.0-alpha5" }, { "last_affected": "3.0.0-alpha5" }, { "introduced": "3.0.0-alpha5" }, { "last_affected": "3.0.0-alpha5" }, { "introduced": "3.0.0-alpha6" }, { "last_affected": "3.0.0-alpha6" }, { "introduced": "3.0.0-alpha6" }, { "last_affected": "3.0.0-alpha6" }, { "introduced": "3.0.0-alpha7" }, { "last_affected": "3.0.0-alpha7" }, { "introduced": "3.0.0-alpha7" }, { "last_affected": "3.0.0-alpha7" }, { "introduced": "3.0.0-alpha8" }, { "last_affected": "3.0.0-alpha8" }, { "introduced": "3.0.0-alpha8" }, { "last_affected": "3.0.0-alpha8" }, { "introduced": "3.0.0-alpha9" }, { "last_affected": "3.0.0-alpha9" }, { "introduced": "3.0.0-alpha9" }, { "last_affected": "3.0.0-alpha9" }, { "introduced": "3.0.0-beta1" }, { "last_affected": "3.0.0-beta1" }, { "introduced": "3.0.0-beta1" }, { "last_affected": "3.0.0-beta1" }, { "introduced": "3.0.0-beta2" }, { "last_affected": "3.0.0-beta2" }, { "introduced": "3.0.0-beta2" }, { "last_affected": "3.0.0-beta2" } ], "source": "CPE_STRING" } ], "vendor_product": "openssl:openssl" }, { "cpes": [ "cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "12.4.0.0" }, { "last_affected": "12.4.0.0" } ], "source": "CPE_STRING" } ], "vendor_product": "oracle:enterprise_manager_ops_center" }, { "cpes": [ "cpe:2.3:a:oracle:health_sciences_inform_publisher:6.2.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:health_sciences_inform_publisher:6.3.1.1:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "6.2.1.1" }, { "last_affected": "6.2.1.1" }, { "introduced": "6.3.1.1" }, { "last_affected": "6.3.1.1" } ], "source": "CPE_STRING" } ], "vendor_product": "oracle:health_sciences_inform_publisher" }, { "cpes": [ "cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2.6.3:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "9.2.6.3" }, { "last_affected": "9.2.6.3" } ], "source": "CPE_STRING" } ], "vendor_product": "oracle:jd_edwards_enterpriseone_tools" }, { "cpes": [ "cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "a9.4" }, { "last_affected": "a9.4" } ], "source": "CPE_STRING" } ], "vendor_product": "oracle:jd_edwards_world_security" }, { "cpes": [ "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "8.58" }, { "last_affected": "8.58" }, { "introduced": "8.59" }, { "last_affected": "8.59" } ], "source": "CPE_STRING" } ], "vendor_product": "oracle:peoplesoft_enterprise_peopletools" }, { "cpes": [ "cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:*", "cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "1.0-NA" }, { "last_affected": "1.0-NA" }, { "introduced": "1.0-sp1" }, { "last_affected": "1.0-sp1" } ], "source": "CPE_STRING" } ], "vendor_product": "siemens:sinec_ins" } ] }- References
-
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3bf7b73ea7123045b8f972badc67ed6878e6c37f
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6fc1aaaf303185aa5e483e06bdfae16daa9193a7
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e9e726506cd2a3fd9c0f12daf8cc1fe934c7dddb
- https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
- https://security.gentoo.org/glsa/202210-02
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://www.debian.org/security/2022/dsa-5103
- https://www.openssl.org/news/secadv/20220128.txt
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
Affected packages
Git
github.com/kzalewski/openssl-1.1.1
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-4160.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "42797208737688127763066522181332281160",
"length": 507
},
"id": "CVE-2021-4160-17161750",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
"target": {
"file": "test/ec_internal_test.c",
"function": "setup_tests"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"230361427007416664995616424352791763469",
"68454496777232705137616949383570055801",
"174227485603324825134703660955423564225",
"306374039697804480350160125378658725435",
"223787537721903344733141597182001711142",
"305852724676774806958748002571762917320",
"61902118637910596077004663207701223681",
"278724473247779637198513168995006009135",
"150804929727413209120953746872414715465",
"166774358343717215765245239236385866693",
"116293081894868411264108492273509366961",
"326496170417124709669304286305887789679",
"278306348133167756990680493182074324125",
"189649085256091224929149730235838635518",
"82945606976757935725900546138315651129",
"136187505923069729147869676886657763243",
"233447734599456461300796481665382809870",
"116930820689846462220149337293161556595",
"153181275943870954612030432229689150702",
"65985025876624501603393736976041980125"
],
"threshold": 0.9
},
"id": "CVE-2021-4160-3349f255",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
"target": {
"file": "crypto/bn/bn_gf2m.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "30673062630639656303483208802482655434",
"length": 494
},
"id": "CVE-2021-4160-4f7f516c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
"target": {
"file": "crypto/bn/bn_gf2m.c",
"function": "BN_GF2m_poly2arr"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"202560716467995180801900703314012126638",
"231076714992210239911677876085986544653",
"119476550149019858610160764241585512883",
"237713134421560846878241190267682686452",
"291912177671523663250360670212314966717",
"148718397703357758449784276736258891876",
"8308956487359903771982894414540058331",
"219665286569007368979236427780197060159"
],
"threshold": 0.9
},
"id": "CVE-2021-4160-f19f6747",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
"target": {
"file": "test/ec_internal_test.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"215474658839038190857768659117172798903",
"224789752300883698945153787266757617261",
"56494159630746388130037307952134413004",
"164370382436795402003615230331141913984",
"149153318460680570484795927015804201404"
],
"threshold": 0.9
},
"id": "CVE-2021-4160-fa870959",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/kzalewski/openssl-1.1.1/commit/9ad69b994ae7c73ba06d9f75efd2625102de814c",
"target": {
"file": "include/openssl/opensslv.h"
}
}
]
vanir_signatures_modified
"2026-11-11T13:22:02Z"
github.com/openssl/openssl
Affected ranges
- Type
- GIT
- Repo
- https://github.com/openssl/openssl
- Events
-
IntroducedLast AffectedIntroducedFixedIntroducedLast Affected
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2" }, { "last_affected": "1.0.2zb" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.1" }, { "fixed": "1.1.1m" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:openssl:openssl:3.0.0:-:*:*:*:*:*:*", "range": [ { "introduced": "3.0.0-NA" }, { "last_affected": "3.0.0-NA" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:3.0.0:alpha1:*:*:*:*:*:*", "range": [ { "introduced": "3.0.0-alpha1" }, { "last_affected": "3.0.0-alpha1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:3.0.0:alpha10:*:*:*:*:*:*", "range": [ { "introduced": "3.0.0-alpha10" }, { "last_affected": "3.0.0-alpha10" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:3.0.0:alpha11:*:*:*:*:*:*", "range": [ { "introduced": "3.0.0-alpha11" }, { "last_affected": "3.0.0-alpha11" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:3.0.0:alpha12:*:*:*:*:*:*", "range": [ { "introduced": "3.0.0-alpha12" }, { "last_affected": "3.0.0-alpha12" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:3.0.0:alpha13:*:*:*:*:*:*", "range": [ { "introduced": "3.0.0-alpha13" }, { "last_affected": "3.0.0-alpha13" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:3.0.0:alpha14:*:*:*:*:*:*", "range": [ { "introduced": "3.0.0-alpha14" }, { "last_affected": "3.0.0-alpha14" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:3.0.0:alpha15:*:*:*:*:*:*", "range": [ { "introduced": "3.0.0-alpha15" }, { "last_affected": "3.0.0-alpha15" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:3.0.0:alpha16:*:*:*:*:*:*", "range": [ { "introduced": "3.0.0-alpha16" }, { "last_affected": "3.0.0-alpha16" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:3.0.0:alpha17:*:*:*:*:*:*", "range": [ { "introduced": "3.0.0-alpha17" }, { "last_affected": "3.0.0-alpha17" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:3.0.0:alpha2:*:*:*:*:*:*", "range": [ { "introduced": "3.0.0-alpha2" }, { "last_affected": "3.0.0-alpha2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:3.0.0:alpha3:*:*:*:*:*:*", "range": [ { "introduced": "3.0.0-alpha3" }, { "last_affected": "3.0.0-alpha3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:3.0.0:alpha4:*:*:*:*:*:*", "range": [ { "introduced": "3.0.0-alpha4" }, { "last_affected": "3.0.0-alpha4" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:3.0.0:alpha5:*:*:*:*:*:*", "range": [ { "introduced": "3.0.0-alpha5" }, { "last_affected": "3.0.0-alpha5" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:3.0.0:alpha6:*:*:*:*:*:*", "range": [ { "introduced": "3.0.0-alpha6" }, { "last_affected": "3.0.0-alpha6" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:3.0.0:alpha7:*:*:*:*:*:*", "range": [ { "introduced": "3.0.0-alpha7" }, { "last_affected": "3.0.0-alpha7" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:3.0.0:alpha8:*:*:*:*:*:*", "range": [ { "introduced": "3.0.0-alpha8" }, { "last_affected": "3.0.0-alpha8" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:3.0.0:alpha9:*:*:*:*:*:*", "range": [ { "introduced": "3.0.0-alpha9" }, { "last_affected": "3.0.0-alpha9" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:3.0.0:beta1:*:*:*:*:*:*", "range": [ { "introduced": "3.0.0-beta1" }, { "last_affected": "3.0.0-beta1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:3.0.0:beta2:*:*:*:*:*:*", "range": [ { "introduced": "3.0.0-beta2" }, { "last_affected": "3.0.0-beta2" } ], "source": "CPE_STRING" } ] }
Affected versions
3.*
3.0.0-NA
3.0.0-alpha1
3.0.0-alpha10
3.0.0-alpha11
3.0.0-alpha12
3.0.0-alpha13
3.0.0-alpha14
3.0.0-alpha15
3.0.0-alpha16
3.0.0-alpha17
3.0.0-alpha2
3.0.0-alpha3
3.0.0-alpha4
3.0.0-alpha5
3.0.0-alpha6
3.0.0-alpha7
3.0.0-alpha8
3.0.0-alpha9
3.0.0-beta1
3.0.0-beta2
Other
OpenSSL_1_0_2u
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-4160.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"28170854778703993674264004058177114599",
"73132526844288570625317440636111911761",
"177405411499435185068645597737938634778",
"224809958623850711330610094965797758930",
"295554444428855106393106961197201359586"
],
"threshold": 0.9
},
"id": "CVE-2021-4160-c377fa22",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/e04bd3433fd84e1861bf258ea37928d9845e6a86",
"target": {
"file": "include/openssl/opensslv.h"
}
}
]
vanir_signatures_modified
"2026-11-11T13:22:02Z"