Skip to content
OpenAdvisories
Medium RLSA-2021:4198 2 CVEs

Moderate: edk2 security, bug fix, and enhancement update

Published Nov 9, 2021 · Updated Feb 4, 2026

Ecosystem: Rocky Linux

Summary

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.

The following packages have been upgraded to a later upstream version: edk2 (20210527gite1999b264f1f). (BZ#1846481, BZ#1938238)

Security Fix(es):

* openssl: integer overflow in CipherUpdate (CVE-2021-23840)

* openssl: NULL pointer dereference in X509_issuer_and_serial_hash() (CVE-2021-23841)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 8 edk2 0:20210527gite1999b264f1f-3.el8

Vulnerabilities 2

  • High 7.5
    CVE-2021-23840 Public exploit EPSS 51%

    Integer overflow in CipherUpdate

    Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the …

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine crates.io
  • Medium 5.9
    CVE-2021-23841 Public exploit

    Null pointer deref in X509_issuer_and_serial_hash()

    The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing …

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine crates.io

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1930310
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1930324
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1937564
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1938238
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1938257
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1956837
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1988762