Skip to content
OpenAdvisories
High RHSA-2021:3798 2 CVEs

Red Hat Security Advisory: openssl security update

Published Sep 13, 2024 · Updated Sep 21, 2026

Ecosystem: Red Hat

Fixed packages 22

ReleasePackageFixed in
Red Hat · RHEL 7 enterprise_linux:7::client openssl 1:1.0.2k-22.el7_9
Red Hat · RHEL 7 enterprise_linux:7::client openssl-debuginfo 1:1.0.2k-22.el7_9
Red Hat · RHEL 7 enterprise_linux:7::client openssl-devel 1:1.0.2k-22.el7_9
Red Hat · RHEL 7 enterprise_linux:7::client openssl-libs 1:1.0.2k-22.el7_9
Red Hat · RHEL 7 enterprise_linux:7::client openssl-perl 1:1.0.2k-22.el7_9
Red Hat · RHEL 7 enterprise_linux:7::client openssl-static 1:1.0.2k-22.el7_9
Red Hat · RHEL 7 enterprise_linux:7::computenode openssl-debuginfo 1:1.0.2k-22.el7_9
Red Hat · RHEL 7 enterprise_linux:7::computenode openssl-devel 1:1.0.2k-22.el7_9
Red Hat · RHEL 7 enterprise_linux:7::computenode openssl-perl 1:1.0.2k-22.el7_9
Red Hat · RHEL 7 enterprise_linux:7::computenode openssl-static 1:1.0.2k-22.el7_9
Red Hat · RHEL 7 enterprise_linux:7::server openssl 1:1.0.2k-22.el7_9
Red Hat · RHEL 7 enterprise_linux:7::server openssl-debuginfo 1:1.0.2k-22.el7_9
Red Hat · RHEL 7 enterprise_linux:7::server openssl-devel 1:1.0.2k-22.el7_9
Red Hat · RHEL 7 enterprise_linux:7::server openssl-libs 1:1.0.2k-22.el7_9
Red Hat · RHEL 7 enterprise_linux:7::server openssl-perl 1:1.0.2k-22.el7_9
Red Hat · RHEL 7 enterprise_linux:7::server openssl-static 1:1.0.2k-22.el7_9
Red Hat · RHEL 7 enterprise_linux:7::workstation openssl 1:1.0.2k-22.el7_9
Red Hat · RHEL 7 enterprise_linux:7::workstation openssl-debuginfo 1:1.0.2k-22.el7_9
Red Hat · RHEL 7 enterprise_linux:7::workstation openssl-devel 1:1.0.2k-22.el7_9
Red Hat · RHEL 7 enterprise_linux:7::workstation openssl-libs 1:1.0.2k-22.el7_9
Red Hat · RHEL 7 enterprise_linux:7::workstation openssl-perl 1:1.0.2k-22.el7_9
Red Hat · RHEL 7 enterprise_linux:7::workstation openssl-static 1:1.0.2k-22.el7_9

Vulnerabilities 2

  • High 7.5
    CVE-2021-23840 Public exploit EPSS 51%

    Integer overflow in CipherUpdate

    Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the …

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine crates.io
  • Medium 5.9
    CVE-2021-23841 Public exploit

    Null pointer deref in X509_issuer_and_serial_hash()

    The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing …

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine crates.io

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1930310
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1930324
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3798.json
  • report
    https://access.redhat.com/security/cve/CVE-2021-23840
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-23840
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-23840
  • article
    https://www.openssl.org/news/secadv/20210216.txt
  • report
    https://access.redhat.com/security/cve/CVE-2021-23841
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-23841
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-23841