Lucene search

OpensslCVE-2021-23840

HistoryFeb 16, 2021 - 5:15 p.m.

CVE-2021-23840

2021-02-1617:15:13

CWE-190

openssl

web.nvd.nist.gov

615

cve-2021-23840

openssl

evp_cipherupdate

evp_encryptupdate

evp_decryptupdate

security

vulnerability

update

nvd

overflow

integer overflow

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.9

Confidence

High

EPSS

0.008

Percentile

82.3%

JSON

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Affected configurations

Nvd

Node

opensslopensslRange1.0.2–1.0.2y

opensslopensslRange1.1.1–1.1.1j

Node

debiandebian_linuxMatch10.0

Node

tenablelog_correlation_engineRange<6.0.8

tenablenessus_network_monitorMatch5.11.0

tenablenessus_network_monitorMatch5.11.1

tenablenessus_network_monitorMatch5.12.0

tenablenessus_network_monitorMatch5.12.1

tenablenessus_network_monitorMatch5.13.0

Node

oraclebusiness_intelligenceMatch5.5.0.0.0enterprise

oraclebusiness_intelligenceMatch5.9.0.0.0enterprise

oraclebusiness_intelligenceMatch12.2.1.3.0enterprise

oraclebusiness_intelligenceMatch12.2.1.4.0enterprise

oraclecommunications_cloud_native_core_policyMatch1.15.0

oracleenterprise_manager_for_storage_managementMatch13.4.0.0

oracleenterprise_manager_ops_centerMatch12.4.0.0

oraclegraalvmMatch19.3.5enterprise

oraclegraalvmMatch20.3.1.2enterprise

oraclegraalvmMatch21.0.0.2enterprise

oraclejd_edwards_enterpriseone_toolsRange<9.2.6.0

oraclejd_edwards_world_securityMatcha9.4

oraclemysql_serverRange<5.7.33

oraclemysql_serverRange8.0.15–8.0.23

oraclenosql_databaseRange<20.3

Node

mcafeeepolicy_orchestratorRange<5.10.0

mcafeeepolicy_orchestratorMatch5.10.0-

mcafeeepolicy_orchestratorMatch5.10.0update_1

mcafeeepolicy_orchestratorMatch5.10.0update_10

mcafeeepolicy_orchestratorMatch5.10.0update_2

mcafeeepolicy_orchestratorMatch5.10.0update_3

mcafeeepolicy_orchestratorMatch5.10.0update_4

mcafeeepolicy_orchestratorMatch5.10.0update_5

mcafeeepolicy_orchestratorMatch5.10.0update_6

mcafeeepolicy_orchestratorMatch5.10.0update_7

mcafeeepolicy_orchestratorMatch5.10.0update_8

mcafeeepolicy_orchestratorMatch5.10.0update_9

Node

fujitsum10-1_firmwareRange<xcp2410

AND

fujitsum10-1Match-

Node

fujitsum10-4_firmwareRange<xcp2410

AND

fujitsum10-4Match-

Node

fujitsum10-4s_firmwareRange<xcp2410

AND

fujitsum10-4sMatch-

Node

fujitsum12-1_firmwareRange<xcp2410

AND

fujitsum12-1Match-

Node

fujitsum12-2_firmwareRange<xcp2410

AND

fujitsum12-2Match-

Node

fujitsum12-2s_firmwareRange<xcp2410

AND

fujitsum12-2sMatch-

Node

fujitsum10-1_firmwareRange<xcp3110

AND

fujitsum10-1Match-

Node

fujitsum10-4_firmwareRange<xcp3110

AND

fujitsum10-4Match-

Node

fujitsum10-4s_firmwareRange<xcp3110

AND

fujitsum10-4sMatch-

Node

fujitsum12-1_firmwareRange<xcp3110

AND

fujitsum12-1Match-

Node

fujitsum12-2_firmwareRange<xcp3110

AND

fujitsum12-2Match-

Node

fujitsum12-2s_firmwareRange<xcp3110

AND

fujitsum12-2sMatch-

Node

nodejsnode.jsRange10.0.0–10.12.0-

nodejsnode.jsRange10.13.0–10.24.0lts

nodejsnode.jsRange12.0.0–12.12.0-

nodejsnode.jsRange12.13.0–12.21.0lts

nodejsnode.jsRange14.0.0–14.14.0-

nodejsnode.jsRange15.0.0–15.10.0-

nodejsnode.jsMatch14.15.0lts

CNA Affected

[
  {
    "vendor": "OpenSSL",
    "product": "OpenSSL",
    "versions": [
      {
        "version": "Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i)",
        "status": "affected"
      },
      {
        "version": "Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x)",
        "status": "affected"
      }
    ]
  }
]