vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2021-23840

Integer overflow in CipherUpdate

HIGH
7.5
CVSS Score
Published: February 16, 2021 at 04:55 PM UTC
Updated: June 17, 2026 at 03:38 AM UTC
27 products affected across 7 vendorsDebian LinuxMySQL ServerOpenSSL

Using OpenSSL by OpenSSL?

Get instant alerts when new vulnerabilities affect OpenSSL - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.5
Exploit prediction
EPSS 51%
SSVC
No known exploit

Description

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux· Debiandrupal
95%
10.0
M10-1 Firmware· Fujitsu
95%
v < xcp2410v < xcp3110
Affected range stops below xcp2410, so it looks safe — our inference, not a vendor statement
Affected range stops below xcp3110, so it looks safe — our inference, not a vendor statement
fujitsu-m10-1 (same device)
M10-4 Firmware· Fujitsu
95%
v < xcp2410v < xcp3110
Affected range stops below xcp2410, so it looks safe — our inference, not a vendor statement
Affected range stops below xcp3110, so it looks safe — our inference, not a vendor statement
fujitsu-m10-4 (same device)
M10-4s Firmware· Fujitsu
95%
v < xcp2410v < xcp3110
Affected range stops below xcp2410, so it looks safe — our inference, not a vendor statement
Affected range stops below xcp3110, so it looks safe — our inference, not a vendor statement
fujitsu-m10-4s (same device)
M12-1 Firmware· Fujitsu
95%
v < xcp2410v < xcp3110
Affected range stops below xcp2410, so it looks safe — our inference, not a vendor statement
Affected range stops below xcp3110, so it looks safe — our inference, not a vendor statement
fujitsu-m12-1 (same device)
M12-2 Firmware· Fujitsu
95%
v < xcp2410v < xcp3110
Affected range stops below xcp2410, so it looks safe — our inference, not a vendor statement
Affected range stops below xcp3110, so it looks safe — our inference, not a vendor statement
fujitsu-m12-2 (same device)
M12-2s Firmware· Fujitsu
95%
v < xcp2410v < xcp3110
Affected range stops below xcp2410, so it looks safe — our inference, not a vendor statement
Affected range stops below xcp3110, so it looks safe — our inference, not a vendor statement
fujitsu-m12-2s (same device)
Epolicy Orchestrator· McAfee
95%
v < 5.10.05.10.05.10.0 update_15.10.0 update_105.10.0 update_25.10.0 update_35.10.0 update_45.10.0 update_55.10.0 update_65.10.0 update_75.10.0 update_85.10.0 update_9
Affected range stops below 5.10.0, so it looks safe — our inference, not a vendor statement
Node.js· Node.js
95%
10.0.0 ≤ v ≤ 10.12.010.13.0 ≤ v < 10.24.012.0.0 ≤ v ≤ 12.12.012.13.0 ≤ v < 12.21.014.0.0 ≤ v ≤ 14.14.015.0.0 ≤ v < 15.10.014.15.0
Affected range stops below 10.24.0, so it looks safe — our inference, not a vendor statement
Affected range stops below 12.21.0, so it looks safe — our inference, not a vendor statement
Affected range stops below 15.10.0, so it looks safe — our inference, not a vendor statement
OpenSSL· OpenSSL
95%
1.0.2 ≤ v < 1.0.2y1.1.1 ≤ v < 1.1.1j
Vendor states this is fixed in 1.0.2y (unaffected)
Vendor states this is fixed in 1.1.1j (unaffected)

References (20)

x_refsource_CONFIRMThird Party Advisory
Source: [email protected]
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Source: [email protected]
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1
Source: [email protected]
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9b1129239f3ebb1d1c98ce9ed41d5c9476c47cb2
Third Party Advisory
Source: [email protected]
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846
Third Party Advisory
Source: [email protected]
https://kc.mcafee.com/corporate/index?page=content&id=SB10366
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
Vendor AdvisoryThird Party Advisory
Source: [email protected]
https://security.gentoo.org/glsa/202103-03

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.5HIGHCISA-ADP
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-190

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card