CVE-2021-23840

HIGH7.5EPSS 0.46%

Integer overflow in CipherUpdate

發布日:2021/8/25修改日:2024/12/16

也稱為:GHSA-qgm6-9472-pwq7ALPINE-CVE-2021-23840BIT-node-2021-23840BIT-node-min-2021-23840RUSTSEC-2021-0057

描述

Calls to `EVP_CipherUpdate`, `EVP_EncryptUpdate` and `EVP_DecryptUpdate` may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash.

受影響套件(9)

Alpine/opensslfrom 0, < 1.1.1j-r0
Alpine/openssl3from 0, < 1.1.1j-r0
Bitnami/node>= 10.0.0, < 10.12.1, >= 10.13.0, < 10.24.0, >= 12.0.0, < 12.12.1, >= 12.13.0, < 12.21.0, >= 14.0.0, < 14.14.1, >= 14.15.0, < 14.15.1, >= 15.0.0, < 15.10.0
Bitnami/node-min>= 10.0.0, < 10.12.1, >= 10.13.0, < 10.24.0, >= 12.0.0, < 12.12.1, >= 12.13.0, < 12.21.0, >= 14.0.0, < 14.14.1, >= 14.15.0, < 14.15.1, >= 15.0.0, < 15.10.0
crates.io/openssl-srcfrom 0, < 111.14.0
crates.io/openssl-src>= 0.0.0-0, < 111.14.0
Debian/opensslfrom 0, < 1.1.0l-1~deb9u3
Debian/opensslfrom 0, < 1.1.1j-1
Debian/openssl1.0from 0, < 1.0.2u-1~deb9u4

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

描述

受影響套件(9)

CVSS 分數

參考連結(31)