CVE-2021-23840

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.1.1i and below OpenSSL versions 1.0.2x and below

Description The issue is related to the functions EVP CipherUpdate, EVP EncryptUpdate, and EVP DecryptUpdate in OpenSSL, which may overflow the output length argument when the input length is close to the maximum permissible length for an integer on the platform. This could cause applications to behave incorrectly or crash. The problem is due to an integer overflow, which can lead to a negative output length value, even though the function call returns a success indicator.

Recommendations For OpenSSL versions 1.1.1i and below, upgrade to OpenSSL 1.1.1j. For OpenSSL versions 1.0.2x and below, premium support customers should upgrade to 1.0.2y, while other users should upgrade to 1.1.1j. As a temporary workaround, consider restricting the use of the vulnerable functions EVP CipherUpdate, EVP EncryptUpdate, and EVP DecryptUpdate until a patch is available.