Security readout for executives and security teams
Plain-English summary
CVE-2021-23840 is an OpenSSL integer overflow that can make affected applications crash or behave incorrectly when processing extremely large cipher update inputs. The business impact is availability, not data theft, but OpenSSL’s broad use makes inventory and vendor patch tracking important.
Executive priority
Treat this as a high-priority availability patching issue, especially for exposed services and products bundling OpenSSL. It is not evidenced here as actively exploited, so prioritize by exposure and business criticality.
Technical view
Affected OpenSSL EVP_CipherUpdate, EVP_EncryptUpdate, and EVP_DecryptUpdate calls can return success while setting a negative output length when input length is near platform integer limits. OpenSSL 1.1.1 through 1.1.1i and 1.0.2 through 1.0.2x are affected. Fixed releases are 1.1.1j and 1.0.2y for premium 1.0.2 support customers.
Likely exposure
Exposure is most likely in servers, appliances, containers, or applications using affected OpenSSL libraries. Practical risk depends on whether reachable code paths pass attacker-influenced, very large input lengths into the affected EVP cipher update APIs.
Exploitation context
The provided bundle does not support active exploitation. It marks KEV as false and includes vendor advisories and fixes, but no cited source here reports in-the-wild exploitation or public weaponization.
Researcher notes
The core issue is CWE-190 in output length handling for EVP cipher update functions. Validation should focus on reachable affected API usage and deployed library versions. Avoid assuming all OpenSSL consumers are exploitable without confirming data flow into near-integer-limit input lengths.
Mitigation direction
- Upgrade OpenSSL 1.1.1 deployments to 1.1.1j or later supported vendor packages.
- For OpenSSL 1.0.2, move to a supported branch or obtain vendor-supported 1.0.2y fixes.
- Apply relevant OS, appliance, and product vendor updates that bundle OpenSSL.
- Prioritize internet-facing and high-availability services using OpenSSL for remediation first.
- Check vendor guidance where OpenSSL is embedded or statically linked.
Validation and detection
- Inventory OpenSSL versions across hosts, containers, appliances, and application dependencies.
- Confirm runtime libraries, not only build-time packages, are fixed.
- Review SBOMs and vendor advisories for products embedding OpenSSL.
- Identify services accepting untrusted large encrypted or decrypted inputs.
- Run regression testing for applications updated to patched OpenSSL packages.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-190: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-23840 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.openssl.org/news/secadv/20210216.txtCVE reference
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1CVE reference
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9b1129239f3ebb1d1c98ce9ed41d5c9476c47cb2CVE reference
- DSA-4855CVE reference · vendor-advisory
- GLSA-202103-03CVE reference · vendor-advisory
- https://www.oracle.com/security-alerts/cpuApr2021.htmlCVE reference
- https://www.tenable.com/security/tns-2021-10CVE reference
- https://www.tenable.com/security/tns-2021-09CVE reference
- https://security.netapp.com/advisory/ntap-20210219-0009/CVE reference
- https://www.tenable.com/security/tns-2021-03CVE reference
- [bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8CVE reference · mailing-list
- [bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8CVE reference · mailing-list
- https://www.oracle.com//security-alerts/cpujul2021.htmlCVE reference
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846CVE reference
- https://www.oracle.com/security-alerts/cpuoct2021.htmlCVE reference
- https://kc.mcafee.com/corporate/index?page=content&id=SB10366CVE reference
- https://www.oracle.com/security-alerts/cpujan2022.htmlCVE reference
- https://www.oracle.com/security-alerts/cpuapr2022.htmlCVE reference
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfCVE reference
- https://security.netapp.com/advisory/ntap-20240621-0006/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Integer Overflow or Wraparound
Integer Overflow or Wraparound represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.