Free tools Windows power users keep installed
One-click scans. No signup required.
OpenSSL 1.1.1k, released on 25 March 2021, fixed two vulnerabilities rated HIGH: one could crash a qualifying TLS server, and the other could bypass a certificate check in a narrowly configured application. Neither issue means every OpenSSL installation was exposed. Risk depends on the version and, for each flaw, the role and configuration of the affected process.
What OpenSSL 1.1.1k fixed
The OpenSSL Project described 1.1.1k as a security-fix release. Its two HIGH-severity fixes address different risks: CVE-2021-3449 concerns server availability during TLS 1.2 renegotiation, while CVE-2021-3450 concerns certificate validation when a particular strict-validation flag is used.
Neither advisory describes remote code execution. CVE-2021-3449 is a denial-of-service issue under specified conditions; CVE-2021-3450 is a conditional certificate-authority check bypass. The release announcement is at OpenSSL 1.1.1 release notes.
How to tell whether a deployment is affected
Check the OpenSSL version actually used by the application, not only a system-wide version string. Applications may bundle OpenSSL or use a vendor package that has backported a fix without changing the upstream version shown. The OpenSSL advisories identify these affected ranges:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →#1 Best Overall
| Issue | Version scope | Conditions that determine exposure | Primary risk |
|---|---|---|---|
| CVE-2021-3449 | OpenSSL 1.1.1 versions before 1.1.1k | The affected process must be a TLS server with TLS 1.2 renegotiation enabled; the advisory’s specified extension conditions must also be met. TLS clients are not affected. | Denial of service through a server crash |
| CVE-2021-3450 | OpenSSL 1.1.1h through 1.1.1j | The application must explicitly set X509_V_FLAG_X509_STRICT and must not retain a certificate-validation purpose that performs the later CA check. |
Conditional CA certificate check bypass |
| Both issues | OpenSSL 1.0.2 | The OpenSSL advisories state that this version line is not affected by either issue. | No remediation required for these two CVEs on this version line |
These conditions matter: a version in an affected range alone does not establish that a particular service can be attacked through every listed flaw. CVE-2021-3449 is relevant to qualifying servers, not TLS clients. CVE-2021-3450 requires both the explicit strict flag and the relevant validation-purpose behavior.
CVE-2021-3449: when a TLS server can crash
CVE-2021-3449 is a NULL pointer dereference in signature-algorithms processing. The OpenSSL Project advisory says, “An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client.” The attack scenario requires a TLS 1.2 renegotiation ClientHello and the extension conditions described in the advisory; the server must also have renegotiation enabled. A crash can interrupt service, making this a denial-of-service risk rather than a claim of code execution.
The advisory excludes TLS clients. For affected deployments, consult the CVE-2021-3449 security advisory for the full technical conditions.
CVE-2021-3450: when strict certificate checks can be bypassed
CVE-2021-3450 involves X509_V_FLAG_X509_STRICT, which the OpenSSL Project says “enables additional security checks of the certificates present in a certificate chain.” The defect affects OpenSSL 1.1.1h through 1.1.1j only when an application explicitly enables that flag and does not retain a certificate-validation purpose that performs a later CA check. Under those circumstances, a CA certificate check can be bypassed.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsThis is not a general claim that certificate validation in every OpenSSL application is bypassed. The application’s validation setup is decisive. See the CVE-2021-3450 security advisory for the conditions and details.
What to do if you still run an affected build
- Identify the library in use. Check the OpenSSL package or bundled library used by the affected service, then establish whether its vendor has applied the fixes. A displayed upstream version can remain unchanged when a distribution backports patches.
- Check the relevant configuration. For CVE-2021-3449, determine whether the process is a TLS server and whether TLS 1.2 renegotiation is enabled. For CVE-2021-3450, review whether the application explicitly sets
X509_V_FLAG_X509_STRICTand whether its certificate-validation purpose is retained. - Apply the vendor-supported fix. Upgrade to OpenSSL 1.1.1k or a later supported vendor build, following the operating-system or software vendor’s package and maintenance guidance. Restart or redeploy services as required by that vendor so they use the fixed library.
- Verify the running service. Confirm the package or bundled library was updated and that the service has loaded the corrected build; package installation alone may not replace a library already loaded into a running process.
Do you need to upgrade from OpenSSL 1.1.1j?
Yes, if the installation is an unpatched upstream 1.1.1j build: it falls before 1.1.1k for CVE-2021-3449 and within the affected range for CVE-2021-3450. Apply the appropriate vendor update rather than assuming the version string alone tells the whole story. A distribution may have backported the fixes, so verify its security status and package advisories. Builds older than 1.1.1j should also be evaluated against the CVE-2021-3449 version range and their deployment configuration.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
