Overflow in OpenSSL EVP CipherUpdate, EVP EncryptUpdate, and EVP DecryptUpdate Functions
Summary
CVE-2021-23840: Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. Affects openssl across 4 version ranges.
< 1.1.1j-r0
< 57679e1c97a90057d5ca9e1f0d1f3c6255d20200
< e5d189ecb9465f4be6235109dd3dbcaab01ddc53
< fab0396eab86e8236899c69d3a56baad00e5af14
Fixed in 1.1.1j-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is an open-source software library that provides cryptographic functions to secure communications over computer networks. It is widely used in various applications, including web servers, email servers, and VPNs. The library implements a wide range of cryptographic algorithms and protocols, making it a critical component for secure communication. However, a vulnerability has been discovered in the EVP_CipherUpdate, EVP_EncryptUpdate, and EVP_DecryptUpdate functions of OpenSSL, which could lead to application crashes or incorrect behavior.
Vulnerability Detail
The vulnerability, identified as CVE-2021-23840, occurs when calls to the EVP_CipherUpdate, EVP_EncryptUpdate, and EVP_DecryptUpdate functions result in an overflow of the output length argument. This overflow can happen when the input length is close to the maximum permissible length for an integer on the platform. While the function call returns a success value of 1, the output length value becomes negative. This can cause applications to behave incorrectly or crash. The vulnerability affects OpenSSL versions 1.1.1i and below, as well as OpenSSL 1.0.2x and below (which is no longer receiving public updates).
How To Fix
Minimum fixed version
1.1.1j-r0
This is the first release that contains the fix.
sudo apk add --upgrade opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to the fixed versions of OpenSSL.
Conclusion
The vulnerability in the EVP_CipherUpdate, EVP_EncryptUpdate, and EVP_DecryptUpdate functions of OpenSSL can lead to application crashes or incorrect behavior. It is important to upgrade to the fixed versions of OpenSSL to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openssl →
FAQ
OpenSSL is an open-source software library that provides cryptographic functions for secure communication over computer networks.
The EVP_CipherUpdate, EVP_EncryptUpdate, and EVP_DecryptUpdate functions in OpenSSL are affected by this vulnerability.
The vulnerability can cause applications to behave incorrectly or crash, potentially leading to a denial of service or other security issues.
OpenSSL versions 1.1.1i and below, as well as OpenSSL 1.0.2x and below, are affected by this vulnerability.
Users should upgrade to OpenSSL 1.1.1j if using versions 1.1.1i and below. Users of OpenSSL 1.0.2x and below with premium support should upgrade to OpenSSL 1.0.2y. Other users of OpenSSL 1.0.2x and below should upgrade to OpenSSL 1.1.1j.
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
