CVE-2021-23841: Apple iPadOS

Medium severity, CVSS 5.9. EPSS: 7.4% chance of exploitation in the next 30 days.

The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Affected products

Apple iPadOS: before 14.6 (fixed in 14.6)
Apple iPhone OS: before 14.6 (fixed in 14.6)
Apple macOS: from 11.1, before 11.4 (fixed in 11.4)
Apple Safari: before 14.1.1 (fixed in 14.1.1)
Debian Debian Linux: version 10.0 only
Netapp Oncommand Insight: affected versions not specified
Netapp Oncommand Workflow Automation: affected versions not specified
Netapp Snapcenter: affected versions not specified
OpenSSL OpenSSL: from 1.0.2, before 1.0.2y (fixed in 1.0.2y); from 1.1.1, before 1.1.1j (fixed in 1.1.1j)
Oracle Business Intelligence: version 5.5.0.0.0 only; version 5.9.0.0.0 only; version 12.2.1.3.0 only; version 12.2.1.4.0 only
Oracle Communications Cloud Native Core Policy: version 1.15.0 only
Oracle Enterprise Manager For Storage Management: version 13.4.0.0 only
Oracle Enterprise Manager Ops Center: version 12.4.0.0 only
Oracle Essbase: version 21.2 only
Oracle Graalvm: version 19.3.5 only; version 20.3.1.2 only; version 21.0.0.2 only
Oracle Jd Edwards World Security: version a9.4 only
Oracle MySQL Enterprise Monitor: before 8.0.23 (fixed in 8.0.23)
Oracle MySQL Server: before 5.7.33 (fixed in 5.7.33); from 8.0.15, before 8.0.23 (fixed in 8.0.23)
Oracle PeopleSoft Enterprise PeopleTools: version 8.57 only; version 8.58 only; version 8.59 only
Oracle ZFS Storage Appliance Kit: version 8.8 only
Siemens Sinec Ins: before 1.0 (fixed in 1.0); version 1.0 only
Tenable Nessus Network Monitor: version 5.11.0 only; version 5.11.1 only; version 5.12.0 only; version 5.12.1 only; version 5.13.0 only
Tenable Tenable.sc: from 5.13.0, up to and including 5.17.0

Published 2021-02-16. Last modified 2026-06-17.