high
7.5
CWE
476 20
Advisory Published
Updated

CVE-2021-23841: Null pointer deref in X509_issuer_and_serial_hash()

First published: Tue Feb 16 2021(Updated: )

Last updated 24 July 2024

Credit: Tavis Ormandy Google openssl-security@openssl.org

Affected SoftwareAffected VersionHow to fix
redhat/jbcs-httpd24-apr<0:1.6.3-107.el8
0:1.6.3-107.el8
redhat/jbcs-httpd24-apr-util<0:1.6.1-84.el8
0:1.6.1-84.el8
redhat/jbcs-httpd24-curl<0:7.78.0-2.el8
0:7.78.0-2.el8
redhat/jbcs-httpd24-httpd<0:2.4.37-78.el8
0:2.4.37-78.el8
redhat/jbcs-httpd24-nghttp2<0:1.39.2-39.el8
0:1.39.2-39.el8
redhat/jbcs-httpd24-openssl<1:1.1.1g-8.el8
1:1.1.1g-8.el8
redhat/jbcs-httpd24-openssl-chil<0:1.0.0-7.el8
0:1.0.0-7.el8
redhat/jbcs-httpd24-openssl-pkcs11<0:0.4.10-22.el8
0:0.4.10-22.el8
redhat/jbcs-httpd24-apr<0:1.6.3-107.jbcs.el7
0:1.6.3-107.jbcs.el7
redhat/jbcs-httpd24-apr-util<0:1.6.1-84.jbcs.el7
0:1.6.1-84.jbcs.el7
redhat/jbcs-httpd24-curl<0:7.78.0-2.jbcs.el7
0:7.78.0-2.jbcs.el7
redhat/jbcs-httpd24-httpd<0:2.4.37-78.jbcs.el7
0:2.4.37-78.jbcs.el7
redhat/jbcs-httpd24-nghttp2<0:1.39.2-39.jbcs.el7
0:1.39.2-39.jbcs.el7
redhat/jbcs-httpd24-openssl<1:1.1.1g-8.jbcs.el7
1:1.1.1g-8.jbcs.el7
redhat/jbcs-httpd24-openssl-chil<0:1.0.0-7.jbcs.el7
0:1.0.0-7.jbcs.el7
redhat/jbcs-httpd24-openssl-pkcs11<0:0.4.10-22.jbcs.el7
0:0.4.10-22.jbcs.el7
redhat/openssl<1:1.0.2k-22.el7_9
1:1.0.2k-22.el7_9
redhat/edk2<0:20210527gite1999b264f1f-3.el8
0:20210527gite1999b264f1f-3.el8
redhat/openssl<1:1.1.1k-4.el8
1:1.1.1k-4.el8
redhat/jws5-tomcat<0:9.0.50-3.redhat_00004.1.el7
0:9.0.50-3.redhat_00004.1.el7
redhat/jws5-tomcat-native<0:1.2.30-3.redhat_3.el7
0:1.2.30-3.redhat_3.el7
redhat/jws5-tomcat-vault<0:1.1.8-4.Final_redhat_00004.1.el7
0:1.1.8-4.Final_redhat_00004.1.el7
redhat/jws5-tomcat<0:9.0.50-3.redhat_00004.1.el8
0:9.0.50-3.redhat_00004.1.el8
redhat/jws5-tomcat-native<0:1.2.30-3.redhat_3.el8
0:1.2.30-3.redhat_3.el8
redhat/jws5-tomcat-vault<0:1.1.8-4.Final_redhat_00004.1.el8
0:1.1.8-4.Final_redhat_00004.1.el8
IBM Security Verify Bridge<=All
redhat/openssl<1.1.1
1.1.1
redhat/openssl<1.0.2
1.0.2
Apple macOS<11.4
11.4
Apple Mobile Safari<14.1.1
14.1.1
Apple iOS, iPadOS, and watchOS<14.6
14.6
Apple iOS, iPadOS, and watchOS<14.6
14.6
OpenSSL libcrypto>=1.0.2<1.0.2y
OpenSSL libcrypto>=1.1.1<1.1.1j
Debian=10.0
Tenable Nessus Network Monitor=5.11.0
Tenable Nessus Network Monitor=5.11.1
Tenable Nessus Network Monitor=5.12.0
Tenable Nessus Network Monitor=5.12.1
Tenable Nessus Network Monitor=5.13.0
tenable tenable.sc>=5.13.0<=5.17.0
Apple Mobile Safari<14.1.1
Apple iOS, iPadOS, and watchOS<14.6
iOS<14.6
Apple iOS and macOS>=11.1<11.4
NetApp OnCommand Insight
NetApp OnCommand Workflow Automation
NetApp SnapCenter
Oracle Business Intelligence Enterprise Edition=5.5.0.0.0
Oracle Business Intelligence Enterprise Edition=5.9.0.0.0
Oracle Business Intelligence Enterprise Edition=12.2.1.3.0
Oracle Business Intelligence Enterprise Edition=12.2.1.4.0
oracle communications Cloud native core policy=1.15.0
oracle enterprise manager for storage management=13.4.0.0
Oracle Enterprise Manager Ops Center=12.4.0.0
Oracle Hyperion Essbase=21.2
Oracle GraalVM Enterprise Edition=19.3.5
Oracle GraalVM Enterprise Edition=20.3.1.2
Oracle GraalVM Enterprise Edition=21.0.0.2
oracle jd edwards world security=a9.4
MySQL Enterprise Monitor<8.0.23
MySQL<5.7.33
MySQL>=8.0.15<8.0.23
Oracle PeopleSoft Enterprise PeopleTools=8.57
Oracle PeopleSoft Enterprise PeopleTools=8.58
Oracle PeopleSoft Enterprise PeopleTools=8.59
Oracle Sun ZFS Storage Appliance Kit=8.8
siemens sinec ins<1.0
siemens sinec ins=1.0
siemens sinec ins=1.0-sp1
debian/openssl
1.1.1w-0+deb11u1
1.1.1w-0+deb11u2
3.0.15-1~deb12u1
3.0.14-1~deb12u2
3.4.1-1

Remedy

https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf

Remedy

https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=122a19ab48091c657f7cb1fb3af9fc07bd557bbf

Remedy

https://www.oracle.com//security-alerts/cpujul2021.html

Remedy

https://www.oracle.com/security-alerts/cpuApr2021.html

Remedy

https://www.oracle.com/security-alerts/cpuapr2022.html

Remedy

https://www.oracle.com/security-alerts/cpuoct2021.html

Remedy

As per upstream "The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources."

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Peer vulnerabilities

(Found alongside the following vulnerabilities)

Frequently Asked Questions

  • What is CVE-2021-23841?

    CVE-2021-23841 is a vulnerability that involves a null pointer dereference in the OpenSSL public API function X509_issuer_and_serial_hash().

  • What is the severity of CVE-2021-23841?

    The severity of CVE-2021-23841 is medium with a CVSS score of 5.9.

  • How does CVE-2021-23841 affect Safari?

    CVE-2021-23841 may affect Safari users, but it is recommended to refer to Apple's support page for specific information and remedies.

  • How do I fix CVE-2021-23841 on Red Hat products?

    To fix CVE-2021-23841 on Red Hat products, update the affected packages to the specified versions provided by Red Hat.

  • What are the references for CVE-2021-23841?

    The references for CVE-2021-23841 can be found at the following URLs: 1. [Apple Support - HT212529](https://support.apple.com/en-us/HT212529) 2. [Apple Support - HT212534](https://support.apple.com/en-us/HT212534) 3. [Apple Support - HT212528](https://support.apple.com/en-us/HT212528)

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203