Red Hat Security Advisory

RHSA-2021:4424

openssl security and bug fix update

Released 2021-11-09 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS (v. 8) openssl-1:1.1.1k-4.el8, openssl-devel-1:1.1.1k-4.el8, openssl-libs-1:1.1.1k-4.el8 +1

Fixes 2 records

TI-2021-06204 CVE-2021-23840 · GHSA-qgm6-9472-pwq7

Integer overflow in CipherUpdate

HIGH 70

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.50732 Published 2021-02-16 Partial fix · 111.14.0 CWE-190

TI-2021-06205 CVE-2021-23841 · GHSA-84rm-qf37-fgc2

Null pointer deref in X509_issuer_and_serial_hash()

LOW 37

The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.0741 Published 2021-02-16 Partial fix · 111.14.0 CWE-476