CVE-2021-23840: openssl-src fixed in 111.14.0

CVE-2021-23840 PUBLISHED CVSS 7.5 HIGH

Integer Overflow in openssl-src

Record from NVD · Published February 16, 2021

openssl-src is fixed in 111.14.0 (crates.io)

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

EPSS 50.73% · 98.9th percentile

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
openssl-src	crates.io	111.14.0
edk2-tools-python	Amazon Linux	20200801stable-1.amzn2.0.5
openssl11-static	Amazon Linux	1:1.1.1g-12.amzn2.0.2
edk2-aarch64	Amazon Linux	20200801stable-1.amzn2.0.5
openssl3	Alpine	1.1.1j-r0
m10-1_firmware	fujitsu	xcp3110, xcp2410
node	DHI	15.10.0, 14.16.0, 12.21.0, 10.24.0
alpine/nodejs-20	alpine	15.10.0, 14.16.0, 12.21.0, 10.24.0
nosql_database	oracle	20.3
alpine/nodejs-22	alpine	15.10.0, 14.16.0, 12.21.0, 10.24.0
edk2	Ubuntu:20.04:LTS	0~20191122.bd85bf54-2ubuntu3.3
node.js	nodejs	15.10.0, 14.14.0, 12.21.0, 12.12.0, 10.24.0, 10.12.0

10 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

50.73%

98.9th percentile

Affected products

Vendor	Product	Versions
oracle	jd_edwards_world_security	9.4
oracle	nosql_database	0
openssl	openssl	1.1.1, 1.0.2
fujitsu	m10-4s_firmware	0, 0
fujitsu	m12-2_firmware	0, 0
oracle	mysql_server	8.0.15, 0
debian	debian_linux	10.0
oracle	business_intelligence	12.2.1.4.0, 5.5.0.0.0, 12.2.1.3.0
nodejs	node.js	12.13.0, 14.0.0, 15.0.0
tenable	nessus_network_monitor	5.12.0, 5.11.0, 5.11.1
oracle	communications_cloud_native_core_policy	1.15.0
mcafee	epolicy_orchestrator	5.10.0, 0
tenable	log_correlation_engine	0
fujitsu	m12-2s_firmware	0, 0
oracle	jd_edwards_enterpriseone_tools	0
fujitsu	m10-1_firmware	0, 0
oracle	enterprise_manager_ops_center	12.4.0.0
fujitsu	m10-4_firmware	0, 0
oracle	enterprise_manager_for_storage_management	13.4.0.0
oracle	graalvm	19.3.5, 20.3.1.2, 21.0.0.2

…and 1 more

Timeline

Feb 16, 2021 CVE Published
Apr 8, 2021 PoC Published (2 in total, the first dated here)
Apr 14, 2021 EPSS Score (30 in total, the first dated here)
Mar 7, 2026 Distribution Patch (13 in total, the first dated here)
Mar 7, 2026 Security Advisory (19 in total, the first dated here)
Aug 25, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2021-23840
vulnetix vdb fixes CVE-2021-23840

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-23840/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →