VYPR
Get started
← All advisories
High severity7.5NVD Advisory· Published Feb 16, 2021· Updated Apr 16, 2026

CVE-2021-23840

CVE-2021-23840

Description

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
openssl-srccrates.io
< 111.14.0111.14.0

Affected products

43
  • McAfee/Epolicy Orchestrator12 versions
    cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:*+ 11 more
    • cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:*range: <5.10.0
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_10:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_9:*:*:*:*:*:*
  • Node.js/Node.js3 versions
    cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*+ 2 more
    • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*range: >=10.0.0,<=10.12.0
    • cpe:2.3:a:nodejs:node.js:14.15.0:*:*:*:lts:*:*:*
    • cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*range: >=10.13.0,<10.24.0
  • OpenSSL Project/OpenSSL
    cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
    Range: >=1.0.2,<1.0.2y
  • Oracle Corporation/Business Intelligence4 versions
    cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:*+ 3 more
    • cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:*
  • Oracle Corporation/Communications Cloud Native Core Policy
    cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*
  • Oracle Corporation/Enterprise Manager For Storage Management
    cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.4.0.0:*:*:*:*:*:*:*
  • Oracle Corporation/Enterprise Manager Ops Center
    cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*
  • Oracle Corporation/Graalvm3 versions
    cpe:2.3:a:oracle:graalvm:19.3.5:*:*:*:enterprise:*:*:*+ 2 more
    • cpe:2.3:a:oracle:graalvm:19.3.5:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:oracle:graalvm:20.3.1.2:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:oracle:graalvm:21.0.0.2:*:*:*:enterprise:*:*:*
  • Oracle Corporation/Jd Edwards Enterpriseone Tools
    cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
    Range: <9.2.6.0
  • Oracle Corporation/Jd Edwards World Security
    cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:*
  • Oracle Corporation/Mysql Server
    cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
    Range: <5.7.33
  • Oracle Corporation/Nosql Database
    cpe:2.3:a:oracle:nosql_database:*:*:*:*:*:*:*:*
    Range: <20.3
  • Tenable/Log Correlation Engine
    cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:*
    Range: <6.0.8
  • Tenable/Nessus Network Monitor5 versions
    cpe:2.3:a:tenable:nessus_network_monitor:5.11.0:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:tenable:nessus_network_monitor:5.11.0:*:*:*:*:*:*:*
    • cpe:2.3:a:tenable:nessus_network_monitor:5.11.1:*:*:*:*:*:*:*
    • cpe:2.3:a:tenable:nessus_network_monitor:5.12.0:*:*:*:*:*:*:*
    • cpe:2.3:a:tenable:nessus_network_monitor:5.12.1:*:*:*:*:*:*:*
    • cpe:2.3:a:tenable:nessus_network_monitor:5.13.0:*:*:*:*:*:*:*
  • Debian/Debian Linux
    cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
  • Fujitsu/M10 1 Firmware
    cpe:2.3:o:fujitsu:m10-1_firmware:*:*:*:*:*:*:*:*
    Range: <xcp2410
  • Fujitsu/M10 4 Firmware
    cpe:2.3:o:fujitsu:m10-4_firmware:*:*:*:*:*:*:*:*
    Range: <xcp2410
  • Fujitsu/M10 4s Firmware
    cpe:2.3:o:fujitsu:m10-4s_firmware:*:*:*:*:*:*:*:*
    Range: <xcp2410
  • Fujitsu/M12 1 Firmware
    cpe:2.3:o:fujitsu:m12-1_firmware:*:*:*:*:*:*:*:*
    Range: <xcp2410
  • Fujitsu/M12 2 Firmware
    cpe:2.3:o:fujitsu:m12-2_firmware:*:*:*:*:*:*:*:*
    Range: <xcp2410
  • Fujitsu/M12 2s Firmware
    cpe:2.3:o:fujitsu:m12-2s_firmware:*:*:*:*:*:*:*:*
    Range: <xcp2410

Patches

9
e5d189ecb946
https://github.com/mysql/mysql-servervia osv
7ed30a748964
https://github.com/mysql/mysql-servervia osv
57679e1c97a9
https://github.com/nodejs/nodevia osv
79ea8c333c0f
https://github.com/nodejs/nodevia osv
ce800870b420
https://github.com/nodejs/nodevia osv
ab8d3c5a1262
https://github.com/nodejs/nodevia osv
7a4f260c5df4
https://github.com/nodejs/nodevia osv
e818b74be217
https://github.com/openssl/opensslvia osv
e04bd3433fd8
https://github.com/openssl/opensslvia osv

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

24

News mentions

0

No linked articles in our index yet.