Critical Buffer Overflow Vulnerability in OpenSSL Package
Summary
ALPINE-CVE-2021-23840: Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. Affects openssl versions < 1.1.1j-r0. Fixed in 1.1.1j-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenSSL is a widely used open-source software library that provides robust cryptographic functions and protocols for secure communication over computer networks. It is integral to many applications and services, enabling secure data transmission and encryption. However, certain versions of OpenSSL are susceptible to a critical vulnerability that can lead to application crashes or unintended behavior.
Vulnerability Detail
The vulnerability arises from calls to EVP_CipherUpdate, EVP_EncryptUpdate, and EVP_DecryptUpdate functions, which may overflow the output length argument when the input length approaches the maximum permissible integer length on the platform. This flaw can result in a negative output length value despite the function returning a success indicator, potentially causing applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected, and while OpenSSL 1.0.2x and below are also impacted, they are no longer supported.
How To Fix
Minimum fixed version
1.1.1j-r0
This is the first release that contains the fix.
sudo apk add --upgrade opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the affected functions until they can upgrade to the patched version. However, this is not a long-term solution and upgrading is strongly recommended.
Conclusion
In summary, the critical buffer overflow vulnerability in OpenSSL can have severe implications for applications relying on this library. Users are strongly advised to upgrade to the patched version 1.1.1j or later to mitigate risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for openssl →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
OpenSSL versions 1.1.1i and below are affected, along with versions 1.0.2x and below, which are no longer supported.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to application crashes or incorrect behavior due to negative output length values being returned from the affected functions.
While a temporary workaround is to avoid using the affected functions, the best course of action is to upgrade to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
