CVE-2021-3450: 
vulnerability analysis and mitigation

The X509_V_FLAG_X509_STRICT flag enables additional security checks of certificates present in a certificate chain. Starting from OpenSSL version 1.1.1h, a vulnerability was discovered where an error in implementing a check to disallow certificates with explicitly encoded elliptic curve parameters overwrote a previous check that confirmed certificates in the chain are valid CA certificates. This effectively bypassed the check preventing non-CA certificates from issuing other certificates. The vulnerability affects OpenSSL versions 1.1.1h and newer, while OpenSSL 1.0.2 is not impacted. The issue was discovered by Benjamin Kaduk and others at Akamai and fixed in OpenSSL 1.1.1k (OpenSSL Advisory).

The vulnerability occurs when the X509_V_FLAG_X509_STRICT verification flag is explicitly set. If a "purpose" is configured, there is a subsequent opportunity for checks that the certificate is a valid CA. All named "purpose" values in libcrypto perform this check, so certificate chains will still be rejected even with the strict flag enabled. A purpose is set by default in libssl client and server certificate verification routines but can be overridden or removed by an application. To be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for certificate verification or override the default purpose for TLS client/server applications (OpenSSL Advisory).

This vulnerability could allow non-CA certificates to issue other certificates when they should not have this capability. This creates a potential security risk where unauthorized certificates could be created and trusted by systems using the affected OpenSSL versions (NVD).

The vulnerability requires specific conditions to be exploitable - the application must explicitly set the X509_V_FLAG_X509_STRICT flag and either not set a certificate verification purpose or override the default purpose. The CVSS base score is 7.4 HIGH with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (NVD).

Users of affected versions should upgrade to OpenSSL 1.1.1k which contains the fix. The vulnerability was fixed by correcting the implementation of the elliptic curve parameter check to preserve the CA certificate validation results. If immediate upgrade is not possible, ensuring certificate verification purposes are properly set can help mitigate the issue since the default libssl client and server verification routines include purpose checks (OpenSSL Advisory).

Multiple vendors and organizations issued advisories and updates to address this vulnerability in their products, including Cisco, NetApp, Red Hat, and others. The vulnerability received significant attention from the security community due to OpenSSL's widespread use in securing network communications (NetApp Advisory).