RHSA-2021:3798: Moderate: openssl security update
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.<br>Security Fix(es):<br><li> openssl: integer overflow in CipherUpdate (CVE-2021-23840)</li> <li> openssl: NULL pointer dereference in X509_issuer_and_serial_hash() (CVE-2021-23841)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2021:3798?
The severity of RHSA-2021:3798 is classified as critical due to the integer overflow vulnerability that can lead to potential exploitation.
How do I fix RHSA-2021:3798?
To fix RHSA-2021:3798, update the OpenSSL packages to version 1.0.2k-22.el7_9 or later.
What vulnerabilities are addressed in RHSA-2021:3798?
RHSA-2021:3798 addresses an integer overflow in CipherUpdate, identified as CVE-2021-23840.
What affected software is associated with RHSA-2021:3798?
The affected software includes openssl, openssl-debuginfo, openssl-devel, openssl-libs, openssl-perl, and openssl-static packages.
Is there a specific version of OpenSSL I need for RHSA-2021:3798?
Yes, you need to upgrade to version 1.0.2k-22.el7_9 for all affected packages.