CVE-2021-23840

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

• CWE-190
• CWE-190

• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfThird Party Advisory
• https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1
• https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9b1129239f3ebb1d1c98ce9ed41d5c9476c47cb2
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846Third Party Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10366Third Party Advisory
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://security.gentoo.org/glsa/202103-03Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210219-0009/Third Party Advisory
• https://security.netapp.com/advisory/ntap-20240621-0006/
• https://www.debian.org/security/2021/dsa-4855Third Party Advisory
• https://www.openssl.org/news/secadv/20210216.txtVendor Advisory
• https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
• https://www.tenable.com/security/tns-2021-03Third Party Advisory
• https://www.tenable.com/security/tns-2021-09Third Party Advisory
• https://www.tenable.com/security/tns-2021-10Third Party Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfThird Party Advisory
• https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1
• https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9b1129239f3ebb1d1c98ce9ed41d5c9476c47cb2
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846Third Party Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10366Third Party Advisory
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://security.gentoo.org/glsa/202103-03Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210219-0009/Third Party Advisory
• https://security.netapp.com/advisory/ntap-20240621-0006/
• https://www.debian.org/security/2021/dsa-4855Third Party Advisory
• https://www.openssl.org/news/secadv/20210216.txtVendor Advisory
• https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
• https://www.tenable.com/security/tns-2021-03Third Party Advisory
• https://www.tenable.com/security/tns-2021-09Third Party Advisory
• https://www.tenable.com/security/tns-2021-10Third Party Advisory

Published

Feb 16, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23835An issue was discovered in flatCore before 2.0.0 build 139. …4.9
• CVE-2021-23836An issue was discovered in flatCore before 2.0.0 build 139. …4.8
• CVE-2021-23837An issue was discovered in flatCore before 2.0.0 build 139. …6.5
• CVE-2021-23838An issue was discovered in flatCore before 2.0.0 build 139. …4.8
• CVE-2021-23839OpenSSL 1.0.2 supports SSLv2. If a client attempts to negoti…3.7
• CVE-2021-2384Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-23841The OpenSSL public API function X509_issuer_and_serial_hash(…5.9
• CVE-2021-23842Communication to the AMC2 uses a state-of-the-art cryptograp…7.1
• CVE-2021-23843The Bosch software tools AccessIPConfig.exe and AmcIpConfig.…7.8
• CVE-2021-23845This vulnerability could allow an attacker to hijack a sessi…8.8
• CVE-2021-23846When using http protocol, the user password is transmitted a…5.9
• CVE-2021-23847A Missing Authentication in Critical Function in Bosch IP ca…9.1