Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade edk2-ovmf | May 4, 2022 | Feb 16, 2021 |
| Alpine Linux | — | Upgrade opensslUpgrade openssl3Upgrade openssl1.1-compat | Aug 22, 2024 | Feb 16, 2021 |
| Amazon Linux Ami 2 | — | Upgrade edk2-aarch64Upgrade openssl-develUpgrade openssl11-develUpgrade openssl-libsUpgrade edk2-ovmfUpgrade openssl-perlUpgrade openssl11-libsUpgrade edk2-toolsUpgrade edk2-tools-docUpgrade openssl-debuginfoUpgrade edk2-tools-pythonUpgrade openssl11-staticUpgrade edk2-debuginfoUpgrade openssl11Upgrade opensslUpgrade openssl11-debuginfoUpgrade openssl-static | Feb 22, 2021 | Feb 16, 2021 |
| Amazon_linux | — | Upgrade openssl | Feb 25, 2021 | Feb 16, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 16, 2021 |
| Centos_linux | — | Upgrade openssl-libs-debuginfoUpgrade openssl-perlUpgrade openssl-staticUpgrade openssl-develUpgrade opensslUpgrade edk2-ovmfUpgrade openssl-debuginfoUpgrade openssl-libsUpgrade openssl-debugsource | Oct 14, 2021 | Feb 16, 2021 |
| Debian | — | Upgrade openssl | Feb 19, 2021 | Feb 16, 2021 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Feb 18, 2021 |
| Freebsd | — | Upgrade nodeUpgrade opensslUpgrade node10Upgrade node14Upgrade node12Upgrade openssl-develUpgrade FreeBSD | Mar 9, 2021 | Mar 9, 2021 |
| Gentoo Linux | — | Upgrade dev-libs/openssl. | Apr 1, 2021 | Feb 16, 2021 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Feb 19, 2021 | Feb 16, 2021 |
| Huawei Euleros 2_0_sp2 | — | Upgrade openssl110f-libsUpgrade openssl110fUpgrade openssl110f-devel | Sep 16, 2021 | Feb 16, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade openssl098e | Apr 30, 2021 | Feb 16, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade openssl111d-develUpgrade openssl111dUpgrade openssl111d-libsUpgrade openssl111d-static | May 19, 2021 | Feb 16, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade compat-openssl10 | May 18, 2021 | Feb 16, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade shim | Jun 2, 2021 | Feb 16, 2021 |
| Ibm Aix | — | Apply the fix or workaround for openssl_advisory33 | Apr 15, 2021 | Feb 16, 2021 |
| Oracle Solaris | — | Upgrade library/security/openssl/openssl-fips-140 to version 2.0.15-11.4.33.0.1.94.0 on Solaris 11.4Upgrade library/security/openssl to version 1.0.2.25-11.4.33.0.1.94.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-10 to version 10.22.1-11.4.32.0.1.88.2 on Solaris 11.4Upgrade runtime/nodejs/nodejs-14 to version 14.16.0-11.4.33.0.1.94.0 on Solaris 11.4Upgrade library/security/openssl/openssl-fips-140 to version 2.0.15-0.175.3.36.0.27.0 on Solaris 11.3Upgrade library/security/openssl-11 to version 1.1.1.10-11.4.33.0.1.94.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-12 to version 12.21.0-11.4.32.0.1.88.2 on Solaris 11.4Upgrade library/security/openssl to version 1.0.2.26-0.175.3.36.0.27.0 on Solaris 11.3Upgrade runtime/nodejs to version 12.21.0-11.4.32.0.1.88.2 on Solaris 11.4 | Apr 21, 2021 | Feb 16, 2021 |
| Oracle_linux | — | Upgrade openssl-perlUpgrade openssl-develUpgrade openssl-staticUpgrade opensslUpgrade openssl-libsUpgrade openssl-debugsource | Oct 13, 2021 | Feb 16, 2021 |
| Pulse Secure Pulse Connect Secure | — | Update Pulse Connect Secure to version 9.1R12 | Jul 15, 2021 | Feb 16, 2021 |
| Redhat_linux | — | Upgrade openssl-staticUpgrade openssl-debugsourceUpgrade openssl-debuginfoUpgrade openssl-develUpgrade openssl-perlUpgrade opensslUpgrade edk2-aarch64Upgrade openssl-libs-debuginfoUpgrade openssl-libsNo solution existsUpgrade edk2-ovmf | Oct 14, 2021 | Feb 16, 2021 |
| Rocky_linux | — | Upgrade openssl-libs-debuginfoUpgrade openssl-perlUpgrade opensslUpgrade openssl-debuginfoUpgrade openssl-libsUpgrade openssl-develUpgrade openssl-debugsource | Mar 12, 2024 | Feb 16, 2021 |
| Suse | — | Upgrade openssl-docUpgrade libopenssl-1_0_0-develUpgrade npm12Upgrade libopenssl1_0_0-hmacUpgrade libopenssl1-develUpgrade nodejs12Upgrade libopenssl0_9_8-hmac-32bitUpgrade nodejs12-docsUpgrade libopenssl1_0_0-x86Upgrade libopenssl1_1-32bitUpgrade nodejs10Upgrade nodejs12-develUpgrade openssl-1_1Upgrade openssl1Upgrade libopenssl1_0_0-32bitUpgrade libopenssl0_9_8-32bitUpgrade libopenssl1_1-hmacUpgrade libopenssl1_0_0-steamUpgrade libopenssl-develUpgrade openssl-1_0_0-docUpgrade libopenssl-1_1-develUpgrade libopenssl0_9_8Upgrade libopenssl-1_1-devel-32bitUpgrade libopenssl1_1-hmac-32bitUpgrade libopenssl0_9_8-hmacUpgrade libopenssl-1_0_0-devel-32bitUpgrade openssl-1_0_0Upgrade openssl1-docUpgrade opensslUpgrade nodejs10-develUpgrade libopenssl10Upgrade openssl-1_1-docUpgrade libopenssl1_1Upgrade nodejs10-docsUpgrade npm10Upgrade openssl-1_0_0-cavsUpgrade libopenssl1_0_0-steam-32bitUpgrade libopenssl1_0_0-hmac-32bitUpgrade libopenssl1_0_0 | Feb 28, 2021 | Feb 16, 2021 |
| Ubuntu | — | Upgrade qemu-efi-armUpgrade libssl1.0.0 (Ubuntu Pro)Upgrade libssl1.1Upgrade openssl (Ubuntu Pro)Upgrade qemu-efiUpgrade ovmfUpgrade qemu-efi-aarch64Upgrade libssl1.0.0Upgrade ovmf-ia32 | Feb 19, 2021 | Feb 16, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 16, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub