CVE-2021-23840

CWE-190 — Integer Overflow20 documents12 sources

Severity

7.5HIGH

EPSS

0.6%

top 29.99%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Fujitsu M10-1 Firmware Fujitsu M10-4 Firmware Fujitsu M10-4s Firmware +18 more

Timeline

PublishedFeb 16

Latest updateSep 18

Description

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions s…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages25 packages

▶crates.ioopenssl-src0.0.0-0 — 111.14.0+1

▶NVDopenssl/openssl1.0.2 — 1.0.2y+1

▶Debianopenssl< 1.1.1j-1+3

▶Ubuntuopenssl< 1.0.2g-1ubuntu4.19+2

▶Ubuntuopenssl1.0< 1.0.2n-1ubuntu5.6

Also affects: Debian Linux 10.0

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

OSV

openssl vulnerabilities↗2024-09-18

▶

OSV

edk2 vulnerabilities↗2021-09-23

▶

GHSA

Integer Overflow in openssl-src↗2021-08-25

▶

OSV

Integer Overflow in openssl-src↗2021-08-25

▶

OSV

Integer overflow in CipherUpdate↗2021-05-01

▶

📋Vendor Advisories

Ubuntu

OpenSSL vulnerabilities↗2024-09-18

▶

Oracle

Oracle Oracle Systems Risk Matrix: XCP Firmware (OpenSSL) — CVE-2021-23840↗2022-01-15

▶

Ubuntu

EDK II vulnerabilities↗2021-09-23

▶

BSD

FreeBSD-SA-21:17.openssl: Multiple vulnerabilities in OpenSSL↗2021-08-24

▶

Ubuntu

OpenSSL vulnerabilities↗2021-02-18

▶

🕵️Threat Intelligence

Huntress

CVE-2021-23840 Vulnerability: Analysis, Detection, Removal | Huntress↗

▶

💬Community

HackerOne

Integer overflow in CipherUpdate↗2021-04-08

▶