# OpenSSL Fixes a High-Severity Flaw That Allowed Crashing of Servers

**URL:** <https://onehack.st/t/openssl-fixes-a-high-severity-flaw-that-allowed-crashing-of-servers/176879>\
**Category:** News & Articles\
**Tags:** hacking\
**Created:** [March 28, 2021, 4:13pm UTC](https://onehack.st/t/openssl-fixes-a-high-severity-flaw-that-allowed-crashing-of-servers/176879 "2021-03-28T16:13:12Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\
**Post date:** [March 28, 2021, 4:13pm UTC](https://onehack.st/t/openssl-fixes-a-high-severity-flaw-that-allowed-crashing-of-servers/176879/1 "2021-03-28T16:13:12Z")

</div>

[![](https://cdn.arstechnica.net/wp-content/uploads/2020/10/wireless-security-800x534.jpg) ](https://cdn.arstechnica.net/wp-content/uploads/2020/10/wireless-security-800x534.jpg)

“OpenSSL, the most widely used software library for implementing website and email encryption, has patched [a high-severity vulnerability that makes it easy for hackers to completely shut down huge numbers of servers](https://arstechnica.com/gadgets/2021/03/openssl-fixes-high-severity-flaw-that-allows-hackers-to-crash-servers/),” reports _Ars Technica:_

_On Thursday, OpenSSL maintainers disclosed and patched a vulnerability that causes servers to crash when they receive a maliciously crafted request from an unauthenticated end user. CVE-2021-3449, as the denial-of-server vulnerability is tracked, is the result of a null pointer dereference bug. Cryptographic engineer Filippo Valsorda [said on Twitter](https://twitter.com/FiloSottile/status/1375088690729517059) that the flaw could probably have been discovered earlier than now._

 

“Anyway, sounds like you can crash most OpenSSL servers on the Internet today,” he added.

_Hackers can exploit the vulnerability by sending a server a maliciously formed renegotiating request during the initial handshake that establishes a secure connection between an end user and a server… The maintainers have rated the severity high. Researchers reported the vulnerability to OpenSSL on March 17. Nokia developers Peter Kästle and Samuel Sapalski provided the fix._  
_Ars Technica_ also reports that OpenSSL “fixed a separate vulnerability that, in edge cases, prevented apps from detecting and rejecting TLS certificates that aren’t digitally signed by a browser-trusted certificate authority.”