{"answers":{"affected":"3 open source packages ship an affected version, including openssl-src. It affects 23 products.","exploited":"There is no known exploitation of CVE-2021-23841 in the wild and no public exploit code.","fix":"Upgrade openssl-src to 111.14.0 or later.","what":"CVE-2021-23841 is a medium-severity vulnerability in Apple Ipados, published on 16 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2021-23841 and fix it if it is affected.\n\nWhat it is: CVE-2021-23841 is a medium-severity vulnerability in Apple Ipados, published on 16 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2021-23841 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- openssl-src (crates.io): affected all versions; fixed in 111.14.0\n- openssl-src (crates.io): affected all versions; fixed in 111.14.0\n- openssl-src (crates.io): affected from 0.0.0-0; fixed in 111.14.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2021-23841/ (Markdown: https://insights.sbomify.com/CVE-2021-23841/index.md)","id":"CVE-2021-23841","markdown":"https://insights.sbomify.com/CVE-2021-23841/index.md","name":"CVE-2021-23841","record":{"aliases":["ALPINE-CVE-2021-23841","AZL-40768","AZL-41571","CLEANSTART-2026-ON27982","CLSA-2021-1614885634","DEBIAN-CVE-2021-23841","GHSA-84rm-qf37-fgc2","JLSEC-2026-222","RUSTSEC-2021-0058","UBUNTU-CVE-2021-23841"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"OpenSSL library","requires_auth":"none","summary":"Attackers can cause a denial of service via null pointer dereference in OpenSSL's X509_issuer_and_serial_hash function when processing malicious certificates.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"openssl","cpe":[{"product":"ipados","vendor":"apple"},{"product":"iphone_os","vendor":"apple"},{"product":"macos","vendor":"apple"},{"product":"safari","vendor":"apple"},{"product":"debian_linux","vendor":"debian"},{"product":"oncommand_insight","vendor":"netapp"},{"product":"oncommand_workflow_automation","vendor":"netapp"},{"product":"snapcenter","vendor":"netapp"},{"product":"openssl","vendor":"openssl"},{"product":"business_intelligence","vendor":"oracle"},{"product":"communications_cloud_native_core_policy","vendor":"oracle"},{"product":"enterprise_manager_for_storage_management","vendor":"oracle"},{"product":"enterprise_manager_ops_center","vendor":"oracle"},{"product":"essbase","vendor":"oracle"},{"product":"graalvm","vendor":"oracle"},{"product":"jd_edwards_world_security","vendor":"oracle"},{"product":"mysql_enterprise_monitor","vendor":"oracle"},{"product":"mysql_server","vendor":"oracle"},{"product":"peoplesoft_enterprise_peopletools","vendor":"oracle"},{"product":"zfs_storage_appliance_kit","vendor":"oracle"},{"product":"sinec_ins","vendor":"siemens"},{"product":"nessus_network_monitor","vendor":"tenable"},{"product":"tenable.sc","vendor":"tenable"}],"cvss":{"score":5.9,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-476","name":"NULL Pointer Dereference"}],"description":"The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).","ecosystems":["crates.io"],"exploits":{"exploitdb":0,"first_seen":"2022-04-29","github_poc":2,"max_poc_stars":0,"metasploit":0,"nuclei":0,"refs":[{"date":"2022-04-29T10:16:14Z","kind":"github_poc","ref":"https://github.com/Trinadh465/external_boringssl_openssl_1.1.0g_CVE-2021-23841","stars":0,"title":null},{"date":"2022-08-05T10:52:16Z","kind":"github_poc","ref":"https://github.com/Satheesh575555/Openssl_1_1_0_CVE-2021-23841","stars":0,"title":null}],"tier":"poc_unverified"},"has_fix":true,"headline":"Null pointer deref in X509_issuer_and_serial_hash()","id":"CVE-2021-23841","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"crates.io","product":"apple:ipados","products":["apple:ipados","apple:iphone_os","apple:macos","apple:safari","debian:debian_linux","netapp:oncommand_insight","netapp:oncommand_workflow_automation","netapp:snapcenter","openssl:openssl","oracle:business_intelligence","oracle:communications_cloud_native_core_policy","oracle:enterprise_manager_ops_center","oracle:essbase","oracle:graalvm","oracle:mysql_enterprise_monitor","oracle:mysql_server","oracle:peoplesoft_enterprise_peopletools","oracle:zfs_storage_appliance_kit"],"type":"null_dereference","year":"2021"},"n_packages":3,"n_references":22,"next":{"headline":"Use of Hard-coded Cryptographic Key","id":"CVE-2021-23842"},"packages":[{"ecosystem":"crates.io","fixed":["111.14.0"],"introduced":["0"],"last_affected":[],"package":"openssl-src","purl":null,"source":"GHSA-84rm-qf37-fgc2"},{"ecosystem":"crates.io","fixed":["111.14.0"],"introduced":["0"],"last_affected":[],"package":"openssl-src","purl":"pkg:cargo/openssl-src","source":"GHSA-84rm-qf37-fgc2"},{"ecosystem":"crates.io","fixed":["111.14.0"],"introduced":["0.0.0-0"],"last_affected":[],"package":"openssl-src","purl":"pkg:cargo/openssl-src","source":"RUSTSEC-2021-0058"}],"prev":{"headline":"Integer overflow in CipherUpdate","id":"CVE-2021-23840"},"products":["OpenSSL"],"published":"2021-02-16","related":[{"cvss_score":10,"headline":"Apple iOS, iPadOS, and macOS Out-of-Bounds Write","id":"CVE-2025-43300","kev_date_added":"2025-08-21","published":"2025-08-21"},{"cvss_score":10,"headline":"Apple Multiple Products WebKit Out-of-Bounds Write","id":"CVE-2025-24201","kev_date_added":"2025-03-13","published":"2025-03-11"},{"cvss_score":10,"headline":"Apple Multiple Products Use-After-Free","id":"CVE-2025-24085","kev_date_added":"2025-01-29","published":"2025-01-27"},{"cvss_score":9.8,"headline":"Apple Multiple Products Memory Corruption","id":"CVE-2025-31200","kev_date_added":"2025-04-17","published":"2025-04-16"},{"cvss_score":9.8,"headline":"Apple Multiple Products Arbitrary Read and Write","id":"CVE-2025-31201","kev_date_added":"2025-04-17","published":"2025-04-16"},{"cvss_score":9.8,"headline":"Apple Memory Corruption","id":"CVE-2022-22587","kev_date_added":"2022-01-28","published":"2022-03-18"},{"cvss_score":9.8,"headline":"Apple iOS, iPadOS, and macOS WebKit Remote Code Execution","id":"CVE-2021-1870","kev_date_added":"2021-11-03","published":"2021-04-02"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-09-16","vendors":["OpenSSL"]},"summary":"Attackers can cause a denial of service via null pointer dereference in OpenSSL's X509_issuer_and_serial_hash function when processing malicious certificates.","url":"https://insights.sbomify.com/CVE-2021-23841/"}