CVE-2021-23840: Debian Linux

High severity, CVSS 7.5. EPSS: 50.7% chance of exploitation in the next 30 days.

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Affected products

Debian Debian Linux: version 10.0 only
Fujitsu m10-1 Firmware: before xcp2410 (fixed in xcp2410); before xcp3110 (fixed in xcp3110)
Fujitsu m10-4 Firmware: before xcp2410 (fixed in xcp2410); before xcp3110 (fixed in xcp3110)
Fujitsu m10-4s Firmware: before xcp2410 (fixed in xcp2410); before xcp3110 (fixed in xcp3110)
Fujitsu m12-1 Firmware: before xcp2410 (fixed in xcp2410); before xcp3110 (fixed in xcp3110)
Fujitsu m12-2 Firmware: before xcp2410 (fixed in xcp2410); before xcp3110 (fixed in xcp3110)
Fujitsu m12-2s Firmware: before xcp2410 (fixed in xcp2410); before xcp3110 (fixed in xcp3110)
McAfee Epolicy Orchestrator: before 5.10.0 (fixed in 5.10.0); version 5.10.0 only
Node.js Node.js: from 10.0.0, up to and including 10.12.0; from 10.13.0, before 10.24.0 (fixed in 10.24.0); from 12.0.0, up to and including 12.12.0; from 12.13.0, before 12.21.0 (fixed in 12.21.0); from 14.0.0, up to and including 14.14.0; from 15.0.0, before 15.10.0 (fixed in 15.10.0); …
OpenSSL OpenSSL: from 1.0.2, before 1.0.2y (fixed in 1.0.2y); from 1.1.1, before 1.1.1j (fixed in 1.1.1j)
Oracle Business Intelligence: version 5.5.0.0.0 only; version 5.9.0.0.0 only; version 12.2.1.3.0 only; version 12.2.1.4.0 only
Oracle Communications Cloud Native Core Policy: version 1.15.0 only
Oracle Enterprise Manager For Storage Management: version 13.4.0.0 only
Oracle Enterprise Manager Ops Center: version 12.4.0.0 only
Oracle Graalvm: version 19.3.5 only; version 20.3.1.2 only; version 21.0.0.2 only
Oracle Jd Edwards Enterpriseone Tools: before 9.2.6.0 (fixed in 9.2.6.0)
Oracle Jd Edwards World Security: version a9.4 only
Oracle MySQL Server: before 5.7.33 (fixed in 5.7.33); from 8.0.15, before 8.0.23 (fixed in 8.0.23)
Oracle Nosql Database: before 20.3 (fixed in 20.3)
Tenable Log Correlation Engine: before 6.0.8 (fixed in 6.0.8)
Tenable Nessus Network Monitor: version 5.11.0 only; version 5.11.1 only; version 5.12.0 only; version 5.12.1 only; version 5.13.0 only

Published 2021-02-16. Last modified 2026-06-17.