CVE-2021-4160

There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH private key among multiple clients, which is no longer an option since CVE-2016-0701. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0.0. It was addressed in the releases of 1.1.1m and 3.0.1 on the 15th of December 2021. For the 1.0.2 release it is addressed in git commit 6fc1aaaf3 that is available to premium support customers only. It will be made available in 1.0.2zc when it is released. The issue only affects OpenSSL on MIPS platforms. Fixed in OpenSSL 3.0.1 (Affected 3.0.0). Fixed in OpenSSL 1.1.1m (Affected 1.1.1-1.1.1l). Fixed in OpenSSL 1.0.2zc-dev (Affected 1.0.2-1.0.2zb).

References

Affected packages

Git / github.com/openssl/openssl

Affected ranges

Type

GIT

Repo

https://github.com/openssl/openssl

Events

Introduced

e818b74be2170fbe957a07b0da4401c2b694b3b8

Last affected

e818b74be2170fbe957a07b0da4401c2b694b3b8

Introduced

e04bd3433fd84e1861bf258ea37928d9845e6a86

Fixed

e04bd3433fd84e1861bf258ea37928d9845e6a86

Introduced

Last affected

89cd17a031e022211684eb7eb41190cf1910f9fa

Introduced

Last affected

05feb0a0f1fecb6839888bb7590fb92be70d8d3c

Introduced

Last affected

cae118f9382c3790359b3ff050d6e01c11579a7f

Introduced

Last affected

31a89254d8225bab5c33be88e08296786da6af6a

Introduced

Last affected

b467d394eb11ac94500d9f003426f5fa75d60c3c

Introduced

Last affected

88df2c0b3d6162971304c06a240deb9320c9ae67

Introduced

Last affected

f510d614a7e981cbf69f11ae186c97d3fa00dda9

Introduced

Last affected

b07412ef80ebbcdb8ce2c9fbf714802288fc7ee4

Introduced

Last affected

d0c041b13ad12c2c689313c607e2c001f3d5a1b7

Introduced

Last affected

036f8e71e39a9005cf55cd1f832dd7aafc06ae84

Introduced

Last affected

9e8604b891483e2d06bb994460ca18b93011fdde

Introduced

Last affected

3952c5a312bde6479578dcbc162ec6ce77318924

Introduced

Last affected

38778b78e02e7eb721880ee9e33e0c398e1e677f

Introduced

Last affected

e70a2d9f139e69f0f8a0846a170623256e424dea

Introduced

Last affected

e3ec8020b433f9bccebb547889e43c4691eb8713

Introduced

Last affected

f9a5682e5c0fbf8b17319d71b0040dba9f8b46ee

Introduced

Last affected

20d7295cb0529882306c370f5dd895f412bbf59b

Introduced

Last affected

68ec3d4730a52d32edb35cb602f6580f27d64e8b

Introduced

Last affected

f9bfdc3aa979eb32d4b8341999473f2ad202d889

Introduced

Last affected

9f551541e84eead1d42604b7d5e61885e8e34be0

Introduced

Fixed

bf059c2efc4db5c09970fd3d2c392432b0ac6a12

Introduced

Last affected

bf059c2efc4db5c09970fd3d2c392432b0ac6a12

Introduced

Last affected

888759a1d38197f29de7227876c3b58fbff8549f

Database specific

{
    "versions": [
        {
            "introduced": "1.0.2"
        },
        {
            "last_affected": "1.0.2zb"
        },
        {
            "introduced": "1.1.1"
        },
        {
            "fixed": "1.1.1m"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.0-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.0-alpha1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.0-alpha10"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.0-alpha11"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.0-alpha12"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.0-alpha13"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.0-alpha14"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.0-alpha15"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.0-alpha16"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.0-alpha17"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.0-alpha2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.0-alpha3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.0-alpha4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.0-alpha5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.0-alpha6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.0-alpha7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.0-alpha8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.0-alpha9"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.0-beta1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.0-beta2"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "1.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.0-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.0-sp1"
        }
    ]
}

Affected versions

Other

BEFORE_engine

BEN_FIPS_TEST_7

BEN_FIPS_TEST_8

FIPS_TEST_10

FIPS_TEST_9

OpenSSL_0_9_1c

OpenSSL_0_9_2b

OpenSSL_0_9_3

OpenSSL_0_9_3a

OpenSSL_0_9_3beta2

OpenSSL_0_9_4

OpenSSL_0_9_5a

OpenSSL_0_9_5a-beta1

OpenSSL_0_9_5a-beta2

OpenSSL_0_9_5beta1

OpenSSL_0_9_5beta2

OpenSSL_0_9_6-beta3

OpenSSL_0_9_7

OpenSSL_0_9_7-beta1

OpenSSL_0_9_7-beta2

OpenSSL_0_9_7-beta3

OpenSSL_0_9_7-beta4

OpenSSL_0_9_7-beta6

OpenSSL_0_9_7a

OpenSSL_0_9_7b

OpenSSL_0_9_7c

OpenSSL_0_9_7e

OpenSSL_0_9_7f

OpenSSL_0_9_7g

OpenSSL_0_9_7h

OpenSSL_0_9_7i

OpenSSL_1_0_1

OpenSSL_1_0_1-beta1

OpenSSL_1_0_1-beta2

OpenSSL_1_0_1-beta3

OpenSSL_1_0_1-post-auto-reformat

OpenSSL_1_0_1-post-reformat

OpenSSL_1_0_1-pre-auto-reformat

OpenSSL_1_0_1-pre-reformat

OpenSSL_1_0_1a

OpenSSL_1_0_1b

OpenSSL_1_0_1c

OpenSSL_1_0_1d

OpenSSL_1_0_1e

OpenSSL_1_0_1f

OpenSSL_1_0_1g

OpenSSL_1_0_1h

OpenSSL_1_0_1i

OpenSSL_1_0_1j

OpenSSL_1_0_1k

OpenSSL_1_0_1l

OpenSSL_1_0_1m

OpenSSL_1_0_1n

OpenSSL_1_0_1o

OpenSSL_1_0_1p

OpenSSL_1_0_1q

OpenSSL_1_0_1r

OpenSSL_1_0_1s

OpenSSL_1_0_1t

OpenSSL_1_0_1u

OpenSSL_1_0_2u

OpenSSL_1_1_0-pre1

OpenSSL_1_1_0-pre2

OpenSSL_1_1_0-pre3

OpenSSL_1_1_0-pre4

OpenSSL_1_1_0-pre5

OpenSSL_1_1_0-pre6

OpenSSL_1_1_1

OpenSSL_1_1_1-pre1

OpenSSL_1_1_1-pre2

OpenSSL_1_1_1-pre3

OpenSSL_1_1_1-pre4

OpenSSL_1_1_1-pre5

OpenSSL_1_1_1-pre6

OpenSSL_1_1_1-pre7

OpenSSL_1_1_1-pre8

OpenSSL_1_1_1-pre9

OpenSSL_1_1_1a

OpenSSL_1_1_1b

OpenSSL_1_1_1c

OpenSSL_1_1_1d

OpenSSL_1_1_1e

OpenSSL_1_1_1f

OpenSSL_1_1_1g

OpenSSL_1_1_1h

OpenSSL_1_1_1i

OpenSSL_1_1_1j

OpenSSL_1_1_1k

OpenSSL_1_1_1l

OpenSSL_1_1_1m

OpenSSL_1_1_1n

OpenSSL_1_1_1o

OpenSSL_1_1_1p

OpenSSL_1_1_1q

OpenSSL_1_1_1r

OpenSSL_1_1_1s

OpenSSL_1_1_1t

OpenSSL_1_1_1u

OpenSSL_1_1_1v

OpenSSL_FIPS_1_0

master-post-auto-reformat

master-post-reformat

master-pre-auto-reformat

master-pre-reformat

openssl-3.*

openssl-3.0.0

openssl-3.0.0-alpha1

openssl-3.0.0-alpha10

openssl-3.0.0-alpha11

openssl-3.0.0-alpha12

openssl-3.0.0-alpha13

openssl-3.0.0-alpha14

openssl-3.0.0-alpha15

openssl-3.0.0-alpha16

openssl-3.0.0-alpha17

openssl-3.0.0-alpha2

openssl-3.0.0-alpha3

openssl-3.0.0-alpha4

openssl-3.0.0-alpha5

openssl-3.0.0-alpha6

openssl-3.0.0-alpha7

openssl-3.0.0-alpha8

openssl-3.0.0-alpha9

openssl-3.0.0-beta1

openssl-3.0.0-beta2

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "10.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "11.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "6.2.1.1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "6.3.1.1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.2.6.3"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "a9.4"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.58"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.59"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.4.0.0"
            }
        ]
    }
]

vanir_signatures_modified

"2026-04-11T18:45:32Z"

vanir_signatures

[
    {
        "deprecated": false,
        "target": {
            "file": "include/openssl/opensslv.h"
        },
        "id": "CVE-2021-4160-c377fa22",
        "signature_type": "Line",
        "source": "https://github.com/openssl/openssl/commit/e04bd3433fd84e1861bf258ea37928d9845e6a86",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "28170854778703993674264004058177114599",
                "73132526844288570625317440636111911761",
                "177405411499435185068645597737938634778",
                "224809958623850711330610094965797758930",
                "295554444428855106393106961197201359586"
            ],
            "threshold": 0.9
        }
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-4160.json"