NVD - CVE-2021-4160 (original) (raw)
CVE-2021-4160 Detail
Description
There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH private key among multiple clients, which is no longer an option since CVE-2016-0701. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0.0. It was addressed in the releases of 1.1.1m and 3.0.1 on the 15th of December 2021. For the 1.0.2 release it is addressed in git commit 6fc1aaaf3 that is available to premium support customers only. It will be made available in 1.0.2zc when it is released. The issue only affects OpenSSL on MIPS platforms. Fixed in OpenSSL 3.0.1 (Affected 3.0.0). Fixed in OpenSSL 1.1.1m (Affected 1.1.1-1.1.1l). Fixed in OpenSSL 1.0.2zc-dev (Affected 1.0.2-1.0.2zb).
Metrics
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 4.0 Severity and Vector Strings:
NIST: NVD
N/A
NVD assessment not yet provided.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base Score: 5.9 MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 Severity and Vector Strings:
NIST: NVD
Base Score: 4.3 MEDIUM
Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information | NIST |
Known Affected Software Configurations Switch to CPE 2.2
CPEs loading, please wait.
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
15 change records found show changes
CVE Modified by CISA-ADP 6/17/2026 12:19:08 AM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | SSVC | {"timestamp":"2024-06-24T15:29:13.671400Z","id":"CVE-2021-4160","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"} |
CVE Modified by OpenSSL Software Foundation 6/17/2026 12:19:08 AM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | Affected | [{"vendor":"OpenSSL","product":"OpenSSL","versions":[{"version":"Fixed in OpenSSL 3.0.1 (Affected 3.0.0)","status":"affected"},{"version":"Fixed in OpenSSL 1.1.1m (Affected 1.1.1-1.1.1l)","status":"affected"},{"version":"Fixed in OpenSSL 1.0.2zc-dev (Affected 1.0.2-1.0.2zb)","status":"affected"}]}] |
CVE Modified by CVE 11/21/2024 1:37:02 AM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | Reference | https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf | |
| Added | Reference | https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3bf7b73ea7123045b8f972badc67ed6878e6c37f | |
| Added | Reference | https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6fc1aaaf303185aa5e483e06bdfae16daa9193a7 | |
| Added | Reference | https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e9e726506cd2a3fd9c0f12daf8cc1fe934c7dddb | |
| Added | Reference | https://security.gentoo.org/glsa/202210-02 | |
| Added | Reference | https://security.netapp.com/advisory/ntap-20240621-0006/ | |
| Added | Reference | https://www.debian.org/security/2022/dsa-5103 | |
| Added | Reference | https://www.openssl.org/news/secadv/20220128.txt | |
| Added | Reference | https://www.oracle.com/security-alerts/cpuapr2022.html | |
| Added | Reference | https://www.oracle.com/security-alerts/cpujul2022.html |
CVE Modified by OpenSSL Software Foundation 6/21/2024 3:15:21 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | Reference | OpenSSL Software Foundation https://security.netapp.com/advisory/ntap-20240621-0006/ [No types assigned] |
CVE Modified by OpenSSL Software Foundation 5/14/2024 5:47:36 AM
| Action | Type | Old Value | New Value |
|---|
CVE Modified by OpenSSL Software Foundation 11/06/2023 10:40:17 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | Reference | OpenSSL Software Foundation https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3bf7b73ea7123045b8f972badc67ed6878e6c37f [No types assigned] | |
| Added | Reference | OpenSSL Software Foundation https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6fc1aaaf303185aa5e483e06bdfae16daa9193a7 [No types assigned] | |
| Added | Reference | OpenSSL Software Foundation https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e9e726506cd2a3fd9c0f12daf8cc1fe934c7dddb [No types assigned] | |
| Removed | Reference | OpenSSL Software Foundation https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=3bf7b73ea7123045b8f972badc67ed6878e6c37f | |
| Removed | Reference | OpenSSL Software Foundation https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6fc1aaaf303185aa5e483e06bdfae16daa9193a7 | |
| Removed | Reference | OpenSSL Software Foundation https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e9e726506cd2a3fd9c0f12daf8cc1fe934c7dddb |
Modified Analysis by NIST 11/09/2022 3:46:58 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Changed | Reference Type | https://security.gentoo.org/glsa/202210-02 No Types Assigned | https://security.gentoo.org/glsa/202210-02 Third Party Advisory |
CVE Modified by OpenSSL Software Foundation 10/16/2022 1:15:13 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | Reference | https://security.gentoo.org/glsa/202210-02 [No Types Assigned] |
Modified Analysis by NIST 10/05/2022 10:57:09 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | CPE Configuration | OR *cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* | |
| Added | CPE Configuration | OR *cpe:2.3:a:oracle:health_sciences_inform_publisher:6.2.1.1:*:*:*:*:*:*:* *cpe:2.3:a:oracle:health_sciences_inform_publisher:6.3.1.1:*:*:*:*:*:*:* *cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2.6.3:*:*:*:*:*:*:* *cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:* *cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* *cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* | |
| Added | CPE Configuration | OR *cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:* versions up to (excluding) 1.0 *cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:* *cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:* | |
| Changed | Reference Type | https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf No Types Assigned | https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf Third Party Advisory |
| Changed | Reference Type | https://www.oracle.com/security-alerts/cpuapr2022.html No Types Assigned | https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory |
| Changed | Reference Type | https://www.oracle.com/security-alerts/cpujul2022.html No Types Assigned | https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory |
CVE Modified by OpenSSL Software Foundation 9/13/2022 8:15:10 AM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | Reference | https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf [No Types Assigned] |
CVE Modified by OpenSSL Software Foundation 7/25/2022 2🔞46 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | Reference | https://www.oracle.com/security-alerts/cpujul2022.html [No Types Assigned] |
CVE Modified by OpenSSL Software Foundation 4/19/2022 8:16:35 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | Reference | https://www.oracle.com/security-alerts/cpuapr2022.html [No Types Assigned] |
Modified Analysis by NIST 3/24/2022 12:05:26 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Changed | CPE Configuration | Record truncated, showing 2048 of 3979 characters. View Entire Change Record OR *cpe:2.3:a:openssl:openssl:1.0.2:-:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2g:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2h:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2i:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2j:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2l:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2m:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2n:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2o:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2p:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2q:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2r:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2s:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2t:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2u:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2v:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2w:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2x:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2y:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2za:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2zb:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.1.1:-:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.1.1:pre1:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.1.1:pre2:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.1.1:pre3:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.1.1:pre4:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.1.1:pre5:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.1.1:pre6:*:*:*:*:*:* *cpe: | OR *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 1.0.2 up to (including) 1.0.2zb *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 1.1.1 up to (excluding) 1.1.1m *cpe:2.3:a:openssl:openssl:3.0.0:-:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:3.0.0:alpha1:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:3.0.0:alpha10:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:3.0.0:alpha11:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:3.0.0:alpha12:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:3.0.0:alpha13:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:3.0.0:alpha14:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:3.0.0:alpha15:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:3.0.0:alpha16:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:3.0.0:alpha17:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:3.0.0:alpha2:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:3.0.0:alpha3:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:3.0.0:alpha4:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:3.0.0:alpha5:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:3.0.0:alpha6:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:3.0.0:alpha7:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:3.0.0:alpha8:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:3.0.0:alpha9:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:3.0.0:beta1:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:3.0.0:beta2:*:*:*:*:*:* |
| Changed | Reference Type | https://www.debian.org/security/2022/dsa-5103 No Types Assigned | https://www.debian.org/security/2022/dsa-5103 Third Party Advisory |
CVE Modified by OpenSSL Software Foundation 3/16/2022 7:15:07 AM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | Reference | https://www.debian.org/security/2022/dsa-5103 [No Types Assigned] |
Initial Analysis by NIST 2/07/2022 10:24:19 AM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | CVSS V3.1 | NIST AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N | |
| Added | CVSS V2 | NIST (AV:N/AC:M/Au:N/C:P/I:N/A:N) | |
| Added | CWE | NIST NVD-CWE-noinfo | |
| Added | CPE Configuration | Record truncated, showing 2048 of 3979 characters. View Entire Change Record OR *cpe:2.3:a:openssl:openssl:1.0.2:-:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2g:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2h:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2i:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2j:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2l:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2m:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2n:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2o:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2p:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2q:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2r:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2s:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2t:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2u:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2v:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2w:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2x:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2y:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2za:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.0.2zb:*:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.1.1:-:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.1.1:pre1:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.1.1:pre2:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.1.1:pre3:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.1.1:pre4:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.1.1:pre5:*:*:*:*:*:* *cpe:2.3:a:openssl:openssl:1.1.1:pre6:*:*:*:*:*:* *cpe: | |
| Added | CPE Configuration | OR *cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* *cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* *cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | |
| Changed | Reference Type | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=3bf7b73ea7123045b8f972badc67ed6878e6c37f No Types Assigned | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=3bf7b73ea7123045b8f972badc67ed6878e6c37f Patch, Vendor Advisory |
| Changed | Reference Type | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6fc1aaaf303185aa5e483e06bdfae16daa9193a7 No Types Assigned | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6fc1aaaf303185aa5e483e06bdfae16daa9193a7 Broken Link |
| Changed | Reference Type | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e9e726506cd2a3fd9c0f12daf8cc1fe934c7dddb No Types Assigned | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e9e726506cd2a3fd9c0f12daf8cc1fe934c7dddb Patch, Vendor Advisory |
| Changed | Reference Type | https://www.openssl.org/news/secadv/20220128.txt No Types Assigned | https://www.openssl.org/news/secadv/20220128.txt Vendor Advisory |
Quick Info
CVE Dictionary Entry:
CVE-2021-4160
NVD Published Date:
01/28/2022
NVD Last Modified:
06/17/2026
Source:
OpenSSL Software Foundation