CVE-2021-23840

Published: Feb 16, 2021Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Affected (55)

Products: Openssl: Openssl · Debian: Debian Linux · Tenable: Log Correlation Engine, Nessus Network Monitor · +4 more

Show all products

1 product

1 product

2 products

Log Correlation Engine

Nessus Network Monitor

Oracle

9 products

Business Intelligence

Communications Cloud Native Core Policy

Enterprise Manager For Storage Management

Enterprise Manager Ops Center

Graalvm

Jd Edwards Enterpriseone Tools

Jd Edwards World Security

1 product

6 products

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	From 1.0.2 to 1.0.2y
Openssl Openssl	From 1.1.1 to 1.1.1j

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0

Configuration C

6 vulnerable

Vulnerable Software	Affected Versions
Tenable Log Correlation Engine	Before 6.0.8
Tenable Nessus Network Monitor	Version 5.11.0
Tenable Nessus Network Monitor	Version 5.11.1
Tenable Nessus Network Monitor	Version 5.12.0
Tenable Nessus Network Monitor	Version 5.12.1
Tenable Nessus Network Monitor	Version 5.13.0

Configuration D

15 vulnerable

Vulnerable Software	Affected Versions
Oracle Business Intelligence	Version 12.2.1.3.0
Oracle Business Intelligence	Version 12.2.1.4.0
Oracle Business Intelligence	Version 5.5.0.0.0
Oracle Business Intelligence	Version 5.9.0.0.0
Oracle Communications Cloud Native Core Policy	Version 1.15.0
Oracle Enterprise Manager For Storage Management	Version 13.4.0.0
Oracle Enterprise Manager Ops Center	Version 12.4.0.0
Oracle Graalvm	Version 19.3.5
Oracle Graalvm	Version 20.3.1.2
Oracle Graalvm	Version 21.0.0.2
Oracle Jd Edwards Enterpriseone Tools	Before 9.2.6.0
Oracle Jd Edwards World Security	Version a9.4
Oracle Mysql Server	Before 5.7.33
Oracle Mysql Server	From 8.0.15 to 8.0.23
Oracle Nosql Database	Before 20.3

Configuration E

12 vulnerable

Vulnerable Software	Affected Versions
Mcafee Epolicy Orchestrator	Before 5.10.0
Mcafee Epolicy Orchestrator	Version 5.10.0
Mcafee Epolicy Orchestrator	Version 5.10.0 update_10
Mcafee Epolicy Orchestrator	Version 5.10.0 update_1
Mcafee Epolicy Orchestrator	Version 5.10.0 update_2
Mcafee Epolicy Orchestrator	Version 5.10.0 update_3
Mcafee Epolicy Orchestrator	Version 5.10.0 update_4
Mcafee Epolicy Orchestrator	Version 5.10.0 update_5
Mcafee Epolicy Orchestrator	Version 5.10.0 update_6
Mcafee Epolicy Orchestrator	Version 5.10.0 update_7
Mcafee Epolicy Orchestrator	Version 5.10.0 update_8
Mcafee Epolicy Orchestrator	Version 5.10.0 update_9

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M10 1 Firmware	Before xcp2410

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M10 4 Firmware	Before xcp2410

Configuration H

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M10 4s Firmware	Before xcp2410

Configuration I

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M12 1 Firmware	Before xcp2410

Configuration J

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M12 2 Firmware	Before xcp2410

Configuration K

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M12 2s Firmware	Before xcp2410

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M10 1 Firmware	Before xcp3110

Running on/with	Platform Versions
Fujitsu M10 1	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M10 4 Firmware	Before xcp3110

Running on/with	Platform Versions
Fujitsu M10 4	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M10 4s Firmware	Before xcp3110

Running on/with	Platform Versions
Fujitsu M10 4s	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M12 1 Firmware	Before xcp3110

Running on/with	Platform Versions
Fujitsu M12 1	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M12 2 Firmware	Before xcp3110

Running on/with	Platform Versions
Fujitsu M12 2	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M12 2s Firmware	Before xcp3110

Running on/with	Platform Versions
Fujitsu M12 2s	All versions

Configuration R

7 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	From 10.0.0 to 10.12.0
Nodejs Node.js	From 12.0.0 to 12.12.0
Nodejs Node.js	From 14.0.0 to 14.14.0
Nodejs Node.js	From 15.0.0 to 15.10.0
Nodejs Node.js	From 10.13.0 to 10.24.0
Nodejs Node.js	From 12.13.0 to 12.21.0
Nodejs Node.js	Version 14.15.0

Related CWEs

CWE-190

Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.