CVE-2021-23840
Highopenssl - security update
Published May 11, 2022 · Updated Oct 16, 2026 · Also known as ALPINE-CVE-2021-23840, BIT-node-2021-23840, BIT-node-min-2021-23840, DEBIAN-CVE-2021-23840, DLA-2563-1, DLA-2565-1, EUVD-2021-1843, GHSA-qgm6-9472-pwq7, JLSEC-2026-221, RUSTSEC-2021-0057, SUSE-SU-2021:0725-1, SUSE-SU-2021:0752-1, SUSE-SU-2021:0753-1, SUSE-SU-2021:0754-1, SUSE-SU-2021:0755-1, SUSE-SU-2021:0769-1, SUSE-SU-2021:0793-1, SUSE-SU-2021:0939-1, SUSE-SU-2021:14667-1, SUSE-SU-2021:14670-1, TR-21-0676, TR-22-0340, UBUNTU-CVE-2021-23840, USN-4738-1
Key Facts
Patch immediately- CVE-2021-23840 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Epolicy Orchestrator (Mcafee), Node.js (Nodejs), OpenSSL and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 51% probability of exploitation in the next 30 days.
- Fixed versions are available, including compat-openssl098 0.9.8j-106.24.1, edk2 0:20210527gite1999b264f1f-3.el8, edk2 0~20191122.bd85bf54-2ubuntu3.3.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
51%
Higher than 98.9% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2021-23840 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).
Affected Products
655 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Epolicy OrchestratorMcafee | 5.10.0, 5.10.0-update_1, 5.10.0-update_10, 5.10.0-update_2, 5.10.0-update_3, 5.10.0-update_4, 5.10.0-update_5, 5.10.0-update_6 | 5.10.0 |
| Node.jsNodejs | 14.15.0 | 10.12.0 |
| OpenSSLOpenssl | >= Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i) | 1.0.2y |
| Business IntelligenceOracle | 12.2.1.3.0, 12.2.1.4.0, 5.5.0.0.0, 5.9.0.0.0 | n/a |
| Communications Cloud Native Core PolicyOracle | 1.15.0 | n/a |
Patched Releases
compat-openssl098
0.9.8j-106.24.1
edk2
0:20210527gite1999b264f1f-3.el8, 0~20191122.bd85bf54-2ubuntu3.3, 20210527gite1999b264f1f-3.el8
edk2-aarch64
20200801stable-1.amzn2.0.5
edk2-ovmf
20200801stable-1.amzn2.0.5
edk2-tools
20200801stable-1.amzn2.0.5
edk2-tools-doc
20200801stable-1.amzn2.0.5
edk2-tools-python
20200801stable-1.amzn2.0.5
M10-1 Firmware
xcp2410
M10-4 Firmware
xcp2410
M10-4s Firmware
xcp2410
M12-1 Firmware
xcp2410
M12-2 Firmware
xcp2410
M12-2s Firmware
xcp2410
jbcs-httpd24-apr
0:1.6.3-107.el8jbcs, 0:1.6.3-107.jbcs.el7
jbcs-httpd24-apr-util
0:1.6.1-84.el8jbcs, 0:1.6.1-84.jbcs.el7
jbcs-httpd24-curl
0:7.78.0-2.el8jbcs, 0:7.78.0-2.jbcs.el7
jbcs-httpd24-httpd
0:2.4.37-78.el8jbcs, 0:2.4.37-78.jbcs.el7
jbcs-httpd24-mod_cluster-native
0:1.3.16-9.Final_redhat_2.el8jbcs, 0:1.3.16-9.Final_redhat_2.jbcs.el7
jbcs-httpd24-mod_http2
0:1.15.7-21.el8jbcs, 0:1.15.7-21.jbcs.el7
jbcs-httpd24-mod_jk
0:1.2.48-20.redhat_1.el8jbcs, 0:1.2.48-20.redhat_1.jbcs.el7
jbcs-httpd24-mod_md
1:2.0.8-40.el8jbcs, 1:2.0.8-40.jbcs.el7
jbcs-httpd24-mod_security
0:2.9.2-67.GA.el8jbcs, 0:2.9.2-67.GA.jbcs.el7
jbcs-httpd24-nghttp2
0:1.39.2-39.el8jbcs, 0:1.39.2-39.jbcs.el7
jbcs-httpd24-openssl
1:1.1.1g-8.el8jbcs, 1:1.1.1g-8.jbcs.el7
jbcs-httpd24-openssl-chil
0:1.0.0-7.el8jbcs, 0:1.0.0-7.jbcs.el7
Timeline
Publicly disclosed
May 11, 2022
Last updated
Oct 16, 2026
Weakness Type
- CWE-190 Integer Overflow or Wraparound
References
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11023
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14779
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14781
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14782
FAQ
Common Questions.
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform.
Affected: Epolicy Orchestrator (Mcafee) versions 5.10.0, 5.10.0-update_1, 5.10.0-update_10, 5.10.0-update_2, 5.10.0-update_3, 5.10.0-update_4, 5.10.0-update_5, 5.10.0-update_6; Node.js (Nodejs) versions 14.15.0; OpenSSL versions >= Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including compat-openssl098 0.9.8j-106.24.1, edk2 0:20210527gite1999b264f1f-3.el8, edk2 0~20191122.bd85bf54-2ubuntu3.3.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2021-23840 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo