UpHeron
All vulnerabilities

Servers and applications

CVE-2021-23840

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave…

Severity
High 7.5
Published
16 Feb 2021
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
1.1.1j, 5.7.33, 8.0.23, 10.24.0, 12.21.0, 15.10.0
Sources
NVD

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 15.0.0 before 15.10.0
  • Version 14.15.0
  • From 14.0.0 up to 14.14.0
  • From 12.13.0 before 12.21.0
All 7 release lines
  • From 10.0.0 up to 10.12.0
  • From 10.13.0 before 10.24.0
  • From 12.0.0 up to 12.12.0
  • From 12.13.0 before 12.21.0
  • From 14.0.0 up to 14.14.0
  • Version 14.15.0
  • From 15.0.0 before 15.10.0
OpenSSLServers and applications · cpe:a:openssl:openssl
  • From 1.0.2 before 1.0.2y
  • From 1.1.1 before 1.1.1j
MySQLServers and applications · cpe:a:oracle:mysql_server
  • Every version before 5.7.33
  • From 8.0.15 before 8.0.23

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-23840
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-23840