CVE-2021-4044: Loop with Unreachable Exit Condition ('Infinite Loop')

December 14, 2021 (updated November 9, 2023)

Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. The exact behaviour will depend on the application but it could result in crashes, infinite loops or other similar incorrect responses.

References

git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=758754966791c537ea95241438454aa86f91f256
nvd.nist.gov/vuln/detail/CVE-2021-4044
www.openssl.org/news/secadv/20211214.txt

Code Behaviors & Features

Detect and mitigate CVE-2021-4044 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →