CVE-2021-23840

Katalog CVE

CVSS 7.5 · High EPSS 50,7%

Kerentanan Integer Overflow or Wraparound pada openssl, debian linux +19 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Rincian

Terbit di NVD

16 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound

EPSS (30 hari)

50,7% peluang dieksploitasi; lebih tinggi dari 98,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.openssl.org/news/secadv/20210216.txt advisory vendor
• https://www.oracle.com//security-alerts/cpujul2021.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuApr2021.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuoct2021.html patch · advisory pihak ketiga
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf advisory pihak ketiga
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846 advisory pihak ketiga
• https://kc.mcafee.com/corporate/index?page=content&id=SB10366 advisory pihak ketiga
• https://security.gentoo.org/glsa/202103-03 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210219-0009/ advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-4855 advisory pihak ketiga
• https://www.tenable.com/security/tns-2021-03 advisory pihak ketiga
• https://www.tenable.com/security/tns-2021-09 advisory pihak ketiga
• https://www.tenable.com/security/tns-2021-10 advisory pihak ketiga
• https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1
• https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9b1129239f3ebb1d1c98ce9ed41d5c9476c47cb2
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.boo...
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.boo...
• https://security.netapp.com/advisory/ntap-20240621-0006/