{
    "dataType": "CVE_RECORD",
    "cveMetadata": {
        "state": "PUBLISHED",
        "cveId": "CVE-2021-23840",
        "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "assignerShortName": "openssl",
        "dateUpdated": "2024-09-17T02:16:35.124Z",
        "dateReserved": "2021-01-12T00:00:00",
        "datePublished": "2021-02-16T16:55:18.192713Z"
    },
    "containers": {
        "cna": {
            "title": "Integer overflow in CipherUpdate",
            "datePublic": "2021-02-16T00:00:00",
            "providerMetadata": {
                "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
                "shortName": "openssl",
                "dateUpdated": "2024-06-21T19:07:42.484657"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x)."
                }
            ],
            "affected": [
                {
                    "vendor": "OpenSSL",
                    "product": "OpenSSL",
                    "versions": [
                        {
                            "version": "Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i)",
                            "status": "affected"
                        },
                        {
                            "version": "Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x)",
                            "status": "affected"
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://www.openssl.org/news/secadv/20210216.txt"
                },
                {
                    "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1"
                },
                {
                    "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9b1129239f3ebb1d1c98ce9ed41d5c9476c47cb2"
                },
                {
                    "name": "DSA-4855",
                    "tags": [
                        "vendor-advisory"
                    ],
                    "url": "https://www.debian.org/security/2021/dsa-4855"
                },
                {
                    "name": "GLSA-202103-03",
                    "tags": [
                        "vendor-advisory"
                    ],
                    "url": "https://security.gentoo.org/glsa/202103-03"
                },
                {
                    "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
                },
                {
                    "url": "https://www.tenable.com/security/tns-2021-10"
                },
                {
                    "url": "https://www.tenable.com/security/tns-2021-09"
                },
                {
                    "url": "https://security.netapp.com/advisory/ntap-20210219-0009/"
                },
                {
                    "url": "https://www.tenable.com/security/tns-2021-03"
                },
                {
                    "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
                    "tags": [
                        "mailing-list"
                    ],
                    "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"
                },
                {
                    "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
                    "tags": [
                        "mailing-list"
                    ],
                    "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"
                },
                {
                    "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
                },
                {
                    "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846"
                },
                {
                    "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
                },
                {
                    "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10366"
                },
                {
                    "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
                },
                {
                    "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
                },
                {
                    "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
                },
                {
                    "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "value": "Paul Kehrer"
                }
            ],
            "metrics": [
                {
                    "other": {
                        "content": {
                            "lang": "eng",
                            "url": "https://www.openssl.org/policies/secpolicy.html#Low",
                            "value": "Low"
                        },
                        "type": "unknown"
                    }
                }
            ],
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "type": "text",
                            "lang": "en",
                            "description": "Overflow"
                        }
                    ]
                }
            ]
        },
        "adp": [
            {
                "providerMetadata": {
                    "orgId": "af854a3a-2127-422b-91ae-364da2661108",
                    "shortName": "CVE",
                    "dateUpdated": "2024-08-03T19:14:09.252Z"
                },
                "title": "CVE Program Container",
                "references": [
                    {
                        "url": "https://www.openssl.org/news/secadv/20210216.txt",
                        "tags": [
                            "x_transferred"
                        ]
                    },
                    {
                        "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1",
                        "tags": [
                            "x_transferred"
                        ]
                    },
                    {
                        "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9b1129239f3ebb1d1c98ce9ed41d5c9476c47cb2",
                        "tags": [
                            "x_transferred"
                        ]
                    },
                    {
                        "name": "DSA-4855",
                        "tags": [
                            "vendor-advisory",
                            "x_transferred"
                        ],
                        "url": "https://www.debian.org/security/2021/dsa-4855"
                    },
                    {
                        "name": "GLSA-202103-03",
                        "tags": [
                            "vendor-advisory",
                            "x_transferred"
                        ],
                        "url": "https://security.gentoo.org/glsa/202103-03"
                    },
                    {
                        "url": "https://www.oracle.com/security-alerts/cpuApr2021.html",
                        "tags": [
                            "x_transferred"
                        ]
                    },
                    {
                        "url": "https://www.tenable.com/security/tns-2021-10",
                        "tags": [
                            "x_transferred"
                        ]
                    },
                    {
                        "url": "https://www.tenable.com/security/tns-2021-09",
                        "tags": [
                            "x_transferred"
                        ]
                    },
                    {
                        "url": "https://security.netapp.com/advisory/ntap-20210219-0009/",
                        "tags": [
                            "x_transferred"
                        ]
                    },
                    {
                        "url": "https://www.tenable.com/security/tns-2021-03",
                        "tags": [
                            "x_transferred"
                        ]
                    },
                    {
                        "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
                        "tags": [
                            "mailing-list",
                            "x_transferred"
                        ],
                        "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"
                    },
                    {
                        "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
                        "tags": [
                            "mailing-list",
                            "x_transferred"
                        ],
                        "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"
                    },
                    {
                        "url": "https://www.oracle.com//security-alerts/cpujul2021.html",
                        "tags": [
                            "x_transferred"
                        ]
                    },
                    {
                        "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846",
                        "tags": [
                            "x_transferred"
                        ]
                    },
                    {
                        "url": "https://www.oracle.com/security-alerts/cpuoct2021.html",
                        "tags": [
                            "x_transferred"
                        ]
                    },
                    {
                        "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10366",
                        "tags": [
                            "x_transferred"
                        ]
                    },
                    {
                        "url": "https://www.oracle.com/security-alerts/cpujan2022.html",
                        "tags": [
                            "x_transferred"
                        ]
                    },
                    {
                        "url": "https://www.oracle.com/security-alerts/cpuapr2022.html",
                        "tags": [
                            "x_transferred"
                        ]
                    },
                    {
                        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
                        "tags": [
                            "x_transferred"
                        ]
                    },
                    {
                        "url": "https://security.netapp.com/advisory/ntap-20240621-0006/",
                        "tags": [
                            "x_transferred"
                        ]
                    }
                ]
            }
        ]
    },
    "dataVersion": "5.1"
}