CVE-2021-4044: Loop with Unreachable Exit Condition ('Infinite Loop')

December 14, 2021 (updated November 9, 2023)

Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. The exact behaviour will depend on the application but it could result in crashes, infinite loops or other similar incorrect responses.

References

git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=758754966791c537ea95241438454aa86f91f256
nvd.nist.gov/vuln/detail/CVE-2021-4044
www.openssl.org/news/secadv/20211214.txt

Code Behaviors & Features

Detect and mitigate CVE-2021-4044 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →