OMGeeky/advisory-db
1
0
Fork 0
mirror of https://github.com/OMGeeky/advisory-db.git synced 2025-12-30 16:24:05 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add CVE-2021-23840 for openssl-src (#887)

Browse Source
This commit is contained in:
Alexis Mousset
2021-05-01 14:08:48 +02:00
committed by GitHub
parent d824e5d5c0
commit 35792564ac
1 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
crates/openssl-src/RUSTSEC-0000-0000.md Normal file
View File

@@ -0,0 +1,22 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "openssl-src"
aliases = ["CVE-2021-23840"]
categories = ["denial-of-service"]
date = "2021-05-01"
url = "https://www.openssl.org/news/secadv/20210216.txt"
[versions]
patched = [">= 111.14"]
```
# Integer overflow in CipherUpdate
Calls to `EVP_CipherUpdate`, `EVP_EncryptUpdate` and `EVP_DecryptUpdate` may overflow
the output length argument in some cases where the input length is close to the
maximum permissable length for an integer on the platform. In such cases the
return value from the function call will be 1 (indicating success), but the
output length value will be negative. This could cause applications to behave
incorrectly or crash.