CVE-2021-23840

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

• openssl openssl (>= 1.0.2 < 1.0.2y) • openssl openssl (>= 1.1.1 < 1.1.1j) • debian debian linux 10.0 • tenable log correlation engine (< 6.0.8) • tenable nessus network monitor 5.11.0 • tenable nessus network monitor 5.11.1 • tenable nessus network monitor 5.12.0 • tenable nessus network monitor 5.12.1 • tenable nessus network monitor 5.13.0 • oracle business intelligence 5.5.0.0.0 • oracle business intelligence 5.9.0.0.0 • oracle business intelligence 12.2.1.3.0 • oracle business intelligence 12.2.1.4.0 • oracle communications cloud native core policy 1.15.0 • oracle enterprise manager for storage management 13.4.0.0 • oracle enterprise manager ops center 12.4.0.0 • oracle graalvm 19.3.5 • oracle graalvm 20.3.1.2 • oracle graalvm 21.0.0.2 • oracle jd edwards enterpriseone tools (< 9.2.6.0) • oracle jd edwards world security a9.4 • oracle mysql server (< 5.7.33) • oracle mysql server (>= 8.0.15 < 8.0.23) • oracle nosql database (< 20.3) • mcafee epolicy orchestrator (< 5.10.0) • mcafee epolicy orchestrator 5.10.0 • fujitsu m10-1 firmware (< xcp2410) • fujitsu m10-4 firmware (< xcp2410) • fujitsu m10-4s firmware (< xcp2410) • fujitsu m12-1 firmware (< xcp2410) • fujitsu m12-2 firmware (< xcp2410) • fujitsu m12-2s firmware (< xcp2410) • fujitsu m10-1 firmware (< xcp3110) • fujitsu m10-4 firmware (< xcp3110) • fujitsu m10-4s firmware (< xcp3110) • fujitsu m12-1 firmware (< xcp3110) • fujitsu m12-2 firmware (< xcp3110) • fujitsu m12-2s firmware (< xcp3110) • nodejs node.js (>= 10.0.0 <= 10.12.0) • nodejs node.js (>= 10.13.0 < 10.24.0) • nodejs node.js (>= 12.0.0 <= 12.12.0) • nodejs node.js (>= 12.13.0 < 12.21.0) • nodejs node.js (>= 14.0.0 <= 14.14.0) • nodejs node.js (>= 15.0.0 < 15.10.0) • nodejs node.js 14.15.0