Every CVE Search/ Get API key

CVE-2021-44273

e2guardian v5.4.x <= v5.4.3r is affected by missing SSL certificate validation in the SSL MITM...

7.4 HighFix available

e2guardian v5.4.x <= v5.4.3r is affected by missing SSL certificate validation in the SSL MITM engine. In standalone mode (i.e., acting as a proxy or a transparent proxy), with SSL MITM enabled, e2guardian, if built with OpenSSL v1.1.x, did not validate hostnames in certificates of the web servers that it connected to, and thus was itself vulnerable to MITM attacks.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

1.00%Up 0.1 points since Dec 24, 2021
90%50%10%1%

What each source reports

NVD Score used 7.4

e2guardian v5.4.x <= v5.4.3r is affected by missing SSL certificate validation in the SSL MITM engine. In standalone mode (i.e., acting as a proxy or a transparent proxy), with SSL MITM enabled, e2guardian, if built with OpenSSL v1.1.x, did not validate hostnames in certificates of the web servers that it connected to, and thus was itself vulnerable to MITM attacks.

Record
CVE-2021-44273
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness
CWE-295
Updated
2026-11-02
CVE List No score

e2guardian v5.4.x <= v5.4.3r is affected by missing SSL certificate validation in the SSL MITM engine. In standalone mode (i.e., acting as a proxy or a transparent proxy), with SSL MITM enabled, e2guardian, if built with OpenSSL v1.1.x, did not validate hostnames in certificates of the web servers that it connected to, and thus was itself vulnerable to MITM attacks.

Record
CVE-2021-44273
Updated
2026-11-02
EUVDEUVD-2021-31119 No score

e2guardian v5.4.x <= v5.4.3r is affected by missing SSL certificate validation in the SSL MITM engine. In standalone mode (i.e., acting as a proxy or a transparent proxy), with SSL MITM enabled, e2guardian, if built with OpenSSL v1.1.x, did not validate hostnames in certificates of the web servers that it connected to, and thus was itself vulnerable to MITM attacks.

Record
EUVD-2021-31119
Updated
2026-11-03
GitHub AdvisoriesGHSA-xf97-7h34-8mrr 7.4

e2guardian v5.4.x <= v5.4.3r is affected by missing SSL certificate validation in the SSL MITM...

e2guardian v5.4.x <= v5.4.3r is affected by missing SSL certificate validation in the SSL MITM engine. In standalone mode (i.e., acting as a proxy or a transparent proxy), with SSL MITM enabled, e2guardian, if built with OpenSSL v1.1.x, did not validate hostnames in certificates of the web servers that it connected to, and thus was itself vulnerable to MITM attacks.

Record
GHSA-xf97-7h34-8mrr
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
OSVALPINE-CVE-2021-44273 7.4

e2guardian v5.4.x <= v5.4.3r is affected by missing SSL certificate validation in the SSL MITM engine. In standalone mode (i.e., acting as a proxy or a transparent proxy), with SSL MITM enabled, e2guardian, if built with OpenSSL v1.1.x, did not validate hostnames in certificates of the web servers that it connected to, and thus was itself vulnerable to MITM attacks.

Record
ALPINE-CVE-2021-44273
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-03
OSV 7.4

e2guardian v5.4.x <= v5.4.3r is affected by missing SSL certificate validation in the SSL MITM engine. In standalone mode (i.e., acting as a proxy or a transparent proxy), with SSL MITM enabled, e2guardian, if built with OpenSSL v1.1.x, did not validate hostnames in certificates of the web servers that it connected to, and thus was itself vulnerable to MITM attacks.

Record
CVE-2021-44273
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2021-44273 7.4

e2guardian v5.4.x <= v5.4.3r is affected by missing SSL certificate validation in the SSL MITM engine. In standalone mode (i.e., acting as a proxy or a transparent proxy), with SSL MITM enabled, e2guardian, if built with OpenSSL v1.1.x, did not validate hostnames in certificates of the web servers that it connected to, and thus was itself vulnerable to MITM attacks.

Record
DEBIAN-CVE-2021-44273
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2021-44273 7.4

e2guardian v5.4.x <= v5.4.3r is affected by missing SSL certificate validation in the SSL MITM engine. In standalone mode (i.e., acting as a proxy or a transparent proxy), with SSL MITM enabled, e2guardian, if built with OpenSSL v1.1.x, did not validate hostnames in certificates of the web servers that it connected to, and thus was itself vulnerable to MITM attacks.

Record
UBUNTU-CVE-2021-44273
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVMGASA-2021-0594 No score

Updated e2guardian packages fix security vulnerability

e2guardian did not validate TLS hostnames (CVE-2021-44273)

Record
MGASA-2021-0594
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
e2guardian
Alpine:v3.16
 5.4.0 up to 5.4.5r-r0
5.4.5r-r0
e2guardian
Alpine:v3.17
 5.4.0 up to 5.4.5r-r0
5.4.5r-r0
e2guardian
Alpine:v3.18
 5.4.0 up to 5.4.5r-r0
5.4.5r-r0
e2guardian
Alpine:v3.19
 5.4.0 up to 5.4.5r-r0
5.4.5r-r0
e2guardian
Alpine:v3.20
 5.4.0 up to 5.4.5r-r0
5.4.5r-r0
e2guardian
Alpine:v3.21
 5.4.0 up to 5.4.5r-r0
5.4.5r-r0
e2guardian
Alpine:v3.22
 5.4.0 up to 5.4.5r-r0
5.4.5r-r0
e2guardian
Alpine:v3.23
 5.4.0 up to 5.4.5r-r0
5.4.5r-r0
e2guardian
Alpine:v3.24
 5.4.0 up to 5.4.5r-r0
5.4.5r-r0
e2guardian
Debian:12
 before 5.3.5-3
5.3.5-3
Show 11 moreShow less
Affected packages
PackageAffectedFixed
e2guardian
Debian:13
 before 5.3.5-3
5.3.5-3
e2guardian
Debian:14
 before 5.3.5-3
5.3.5-3
e2guardian
Debian:10
 before 5.3.1-1+deb10u1, plus listed versions
5.3.1-1
5.3.1-1+deb10u1
e2guardian
Mageia:8
 before 5.3.4-1.1.mga8
5.3.4-1.1.mga8
e2guardian
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.4.0.3-2
 None known
e2guardian
Ubuntu:20.04:LTS
 All versions, plus listed versions
5.3.3-15.3.4-1
 None known
e2guardian
Ubuntu:22.04:LTS
 All versions, plus listed versions
5.3.4-25.3.5-15.3.5-25.3.5-2build15.3.5-3
 None known
e2guardian
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.3.5-4.1ubuntu15.3.5-6ubuntu15.3.5-6ubuntu25.3.5-6ubuntu3
 None known
e2guardian
Ubuntu:25.10
 All versions, plus listed versions
5.5.7-15.5.8-1
 None known
e2guardian
Ubuntu:26.10
 All versions, plus listed versions
5.5.9-25.5.9-2ubuntu1
 None known
e2guardian
Ubuntu:26.04:LTS
 All versions, plus listed versions
5.5.8-15.5.9-2
 None known

History

History
RecordedChangedSources
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-44273 is a high vulnerability (CVSS 7.4) in E2bn E2guardian, published December 23, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.00%, the 63rd percentile. Fixed in e2guardian 5.4.5r-r0.

References

Show 6 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open