CVE-2021-23840
Description
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).
How to fix
- openssl openssl1.0.2y, 1.1.1j or later
- tenable log_correlation_engine6.0.8 or later
- oracle jd_edwards_enterpriseone_tools9.2.6.0 or later
- oracle mysql_server5.7.33, 8.0.23 or later
- oracle nosql_database20.3 or later
- mcafee epolicy_orchestrator5.10.0 or later
- fujitsu m10-1_firmwarexcp2410, xcp3110 or later
- fujitsu m10-4_firmwarexcp2410, xcp3110 or later
- fujitsu m10-4s_firmwarexcp2410, xcp3110 or later
- fujitsu m12-1_firmwarexcp2410, xcp3110 or later
- fujitsu m12-2_firmwarexcp2410, xcp3110 or later
- fujitsu m12-2s_firmwarexcp2410, xcp3110 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openssl openssl | 1.0.2 ≤ v < 1.0.2y, 1.1.1 ≤ v < 1.1.1j | 1.0.2y, 1.1.1j |
| debian debian_linux | 10.0 | — |
| tenable log_correlation_engine | v < 6.0.8 | 6.0.8 |
| tenable nessus_network_monitor | 5.11.0, 5.11.1, 5.12.0, 5.12.1, 5.13.0 | — |
| oracle business_intelligence | 5.5.0.0.0, 5.9.0.0.0, 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle communications_cloud_native_core_policy | 1.15.0 | — |
| oracle enterprise_manager_for_storage_management | 13.4.0.0 | — |
| oracle enterprise_manager_ops_center | 12.4.0.0 | — |
| oracle graalvm | 19.3.5, 20.3.1.2, 21.0.0.2 | — |
| oracle jd_edwards_enterpriseone_tools | v < 9.2.6.0 | 9.2.6.0 |
| oracle jd_edwards_world_security | a9.4 | — |
| oracle mysql_server | v < 5.7.33, 8.0.15 ≤ v < 8.0.23 | 5.7.33, 8.0.23 |
| oracle nosql_database | v < 20.3 | 20.3 |
| mcafee epolicy_orchestrator | v < 5.10.0, 5.10.0 | 5.10.0 |
| fujitsu m10-1_firmware | v < xcp2410, v < xcp3110 | xcp2410, xcp3110 |
| fujitsu m10-4_firmware | v < xcp2410, v < xcp3110 | xcp2410, xcp3110 |
| fujitsu m10-4s_firmware | v < xcp2410, v < xcp3110 | xcp2410, xcp3110 |
| fujitsu m12-1_firmware | v < xcp2410, v < xcp3110 | xcp2410, xcp3110 |
| fujitsu m12-2_firmware | v < xcp2410, v < xcp3110 | xcp2410, xcp3110 |
| fujitsu m12-2s_firmware | v < xcp2410, v < xcp3110 | xcp2410, xcp3110 |
| nodejs node.js | 10.0.0 ≤ v ≤ 10.12.0, 10.13.0 ≤ v < 10.24.0, 12.0.0 ≤ v ≤ 12.12.0, 12.13.0 ≤ v < 12.21.0, 14.0.0 ≤ v ≤ 14.14.0, 15.0.0 ≤ v < 15.10.0, 14.15.0 | 10.24.0, 12.21.0, 15.10.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.