Summary
Paul Kehrer discovered that OpenSSL incorrectly handled certain input
lengths in EVP functions. A remote attacker could possibly use this issue
to cause OpenSSL to crash, resulting in a denial of service.
(CVE-2021-23840)
Tavis Ormandy discovered that OpenSSL incorrectly handled parsing issuer
fields. A remote attacker could possibly use this issue to cause OpenSSL to
crash, resulting in a denial of service. (CVE-2021-23841)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | openssl | 1.0.2g-1ubuntu4.19 |
| Ubuntu · 18.04 LTS 18.04:LTS | openssl | 1.1.1-1ubuntu2.1~18.04.8 |
| Ubuntu · 18.04 LTS 18.04:LTS | openssl1.0 | 1.0.2n-1ubuntu5.6 |
| Ubuntu · 20.04 LTS 20.04:LTS | openssl | 1.1.1f-1ubuntu2.2 |
Vulnerabilities 2
-
High 7.5
Integer overflow in CipherUpdate
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the …
-
Medium 5.9CVE-2021-23841 Public exploit
Null pointer deref in X509_issuer_and_serial_hash()
The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing …