Skip to content
OpenAdvisories
Medium ELSA-2021-3798 2 CVEs

Moderate: openssl security update (Oracle Linux 7)

Published Oct 13, 2021 · Updated Oct 13, 2021

Ecosystem: Oracle Linux

Summary

[1.0.2k-22]
- fix CVE-2021-23841 openssl: NULL pointer dereference
in X509_issuer_and_serial_hash()
- fix CVE-2021-23840 openssl: integer overflow in CipherUpdate
- Resolves: rhbz#1932132, rhbz#1932126

Fixed packages 5

ReleasePackageFixed in
Oracle Linux · 7 openssl 1:1.0.2k-22.el7_9
Oracle Linux · 7 openssl-devel 1:1.0.2k-22.el7_9
Oracle Linux · 7 openssl-libs 1:1.0.2k-22.el7_9
Oracle Linux · 7 openssl-perl 1:1.0.2k-22.el7_9
Oracle Linux · 7 openssl-static 1:1.0.2k-22.el7_9

Vulnerabilities 2

  • High 7.5
    CVE-2021-23840 Public exploit EPSS 51%

    Integer overflow in CipherUpdate

    Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the …

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine crates.io
  • Medium 5.9
    CVE-2021-23841 Public exploit

    Null pointer deref in X509_issuer_and_serial_hash()

    The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing …

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine crates.io