Strix
26.1K

CVE-2021-23840

HIGHCVSS 7.5/10EPSS 50.73%

Last modified

CVE-2021-23840 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. EPSS estimates a 50.73% chance of exploitation in the next 30 days.

Description

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability
50.73%

98.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
OpensslOpenssl>= 1.0.2, < 1.0.2y
OpensslOpenssl>= 1.1.1, < 1.1.1j
DebianDebian Linux10.0
TenableLog Correlation Engine< 6.0.8
TenableNessus Network Monitor5.11.0
TenableNessus Network Monitor5.11.1
TenableNessus Network Monitor5.12.0
TenableNessus Network Monitor5.12.1
TenableNessus Network Monitor5.13.0
OracleBusiness Intelligence5.5.0.0.0
OracleBusiness Intelligence5.9.0.0.0
OracleBusiness Intelligence12.2.1.3.0
OracleBusiness Intelligence12.2.1.4.0
OracleCommunications Cloud Native Core Policy1.15.0
OracleEnterprise Manager For Storage Management13.4.0.0
OracleEnterprise Manager Ops Center12.4.0.0
OracleGraalvm19.3.5
OracleGraalvm20.3.1.2
OracleGraalvm21.0.0.2
OracleJd Edwards Enterpriseone Tools< 9.2.6.0
OracleJd Edwards World Securitya9.4
OracleMysql Server< 5.7.33
OracleMysql Server>= 8.0.15, < 8.0.23
OracleNosql Database< 20.3
McafeeEpolicy Orchestrator< 5.10.0
McafeeEpolicy Orchestrator5.10.0
FujitsuM10-1 Firmware< xcp2410
FujitsuM10-4 Firmware< xcp2410
FujitsuM10-4s Firmware< xcp2410
FujitsuM12-1 Firmware< xcp2410
FujitsuM12-2 Firmware< xcp2410
FujitsuM12-2s Firmware< xcp2410
FujitsuM10-1 Firmware< xcp3110
FujitsuM10-4 Firmware< xcp3110
FujitsuM10-4s Firmware< xcp3110
FujitsuM12-1 Firmware< xcp3110
FujitsuM12-2 Firmware< xcp3110
FujitsuM12-2s Firmware< xcp3110
NodejsNode.Js>= 10.0.0, <= 10.12.0
NodejsNode.Js>= 10.13.0, < 10.24.0
NodejsNode.Js>= 12.0.0, <= 12.12.0
NodejsNode.Js>= 12.13.0, < 12.21.0
NodejsNode.Js>= 14.0.0, <= 14.14.0
NodejsNode.Js>= 15.0.0, < 15.10.0
NodejsNode.Js14.15.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-23840?
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).
How severe is CVE-2021-23840?
CVE-2021-23840 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 50.73% probability of exploitation in the next 30 days.
How do I fix CVE-2021-23840?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-23840?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST