Lucene search

[email protected]NVD:CVE-2021-23840

HistoryFeb 16, 2021 - 5:15 p.m.

CVE-2021-23840

2021-02-1617:15:13

CWE-190

[email protected]

web.nvd.nist.gov

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.008 Low

EPSS

Percentile

82.3%

JSON

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Affected configurations

NVD

Node

opensslopensslRange1.0.2–1.0.2y

opensslopensslRange1.1.1–1.1.1j

Node

debiandebian_linuxMatch10.0

Node

tenablelog_correlation_engineRange<6.0.8

tenablenessus_network_monitorMatch5.11.0

tenablenessus_network_monitorMatch5.11.1

tenablenessus_network_monitorMatch5.12.0

tenablenessus_network_monitorMatch5.12.1

tenablenessus_network_monitorMatch5.13.0

Node

oraclebusiness_intelligenceMatch5.5.0.0.0enterprise

oraclebusiness_intelligenceMatch5.9.0.0.0enterprise

oraclebusiness_intelligenceMatch12.2.1.3.0enterprise

oraclebusiness_intelligenceMatch12.2.1.4.0enterprise

oraclecommunications_cloud_native_core_policyMatch1.15.0

oracleenterprise_manager_for_storage_managementMatch13.4.0.0

oracleenterprise_manager_ops_centerMatch12.4.0.0

oraclegraalvmMatch19.3.5enterprise

oraclegraalvmMatch20.3.1.2enterprise

oraclegraalvmMatch21.0.0.2enterprise

oraclejd_edwards_enterpriseone_toolsRange<9.2.6.0

oraclejd_edwards_world_securityMatcha9.4

oraclemysql_serverRange<5.7.33

oraclemysql_serverRange8.0.15–8.0.23

oraclenosql_databaseRange<20.3

Node

mcafeeepolicy_orchestratorRange<5.10.0

mcafeeepolicy_orchestratorMatch5.10.0-

mcafeeepolicy_orchestratorMatch5.10.0update_1

mcafeeepolicy_orchestratorMatch5.10.0update_10

mcafeeepolicy_orchestratorMatch5.10.0update_2

mcafeeepolicy_orchestratorMatch5.10.0update_3

mcafeeepolicy_orchestratorMatch5.10.0update_4

mcafeeepolicy_orchestratorMatch5.10.0update_5

mcafeeepolicy_orchestratorMatch5.10.0update_6

mcafeeepolicy_orchestratorMatch5.10.0update_7

mcafeeepolicy_orchestratorMatch5.10.0update_8

mcafeeepolicy_orchestratorMatch5.10.0update_9

Node

fujitsum10-1_firmwareRange<xcp2410

AND

fujitsum10-1Match-

Node

fujitsum10-4_firmwareRange<xcp2410

AND

fujitsum10-4Match-

Node

fujitsum10-4s_firmwareRange<xcp2410

AND

fujitsum10-4sMatch-

Node

fujitsum12-1_firmwareRange<xcp2410

AND

fujitsum12-1Match-

Node

fujitsum12-2_firmwareRange<xcp2410

AND

fujitsum12-2Match-

Node

fujitsum12-2s_firmwareRange<xcp2410

AND

fujitsum12-2sMatch-

Node

fujitsum10-1_firmwareRange<xcp3110

AND

fujitsum10-1Match-

Node

fujitsum10-4_firmwareRange<xcp3110

AND

fujitsum10-4Match-

Node

fujitsum10-4s_firmwareRange<xcp3110

AND

fujitsum10-4sMatch-

Node

fujitsum12-1_firmwareRange<xcp3110

AND

fujitsum12-1Match-

Node

fujitsum12-2_firmwareRange<xcp3110

AND

fujitsum12-2Match-

Node

fujitsum12-2s_firmwareRange<xcp3110

AND

fujitsum12-2sMatch-

Node

nodejsnode.jsRange10.0.0–10.12.0-

nodejsnode.jsRange10.13.0–10.24.0lts

nodejsnode.jsRange12.0.0–12.12.0-

nodejsnode.jsRange12.13.0–12.21.0lts

nodejsnode.jsRange14.0.0–14.14.0-

nodejsnode.jsRange15.0.0–15.10.0-

nodejsnode.jsMatch14.15.0lts

References

cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1

git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9b1129239f3ebb1d1c98ce9ed41d5c9476c47cb2

kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846

kc.mcafee.com/corporate/index?page=content&id=SB10366

lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E

lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

security.gentoo.org/glsa/202103-03

security.netapp.com/advisory/ntap-20210219-0009/

security.netapp.com/advisory/ntap-20240621-0006/

www.debian.org/security/2021/dsa-4855

www.openssl.org/news/secadv/20210216.txt

www.oracle.com//security-alerts/cpujul2021.html

www.oracle.com/security-alerts/cpuApr2021.html

www.oracle.com/security-alerts/cpuapr2022.html

www.oracle.com/security-alerts/cpujan2022.html

www.oracle.com/security-alerts/cpuoct2021.html

www.tenable.com/security/tns-2021-03

www.tenable.com/security/tns-2021-09

www.tenable.com/security/tns-2021-10

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.008 Low

EPSS

Percentile

82.3%

JSON

CVE-2021-23840

Affected configurations

References

Related