Detections
Analytics

Echo: openssl-1.0.1g: security update to 1.0.1g+e1openssl-1.1.1c: security update to 1.1.1c+e1openssl-1.1.1g: security update to 1.1.1g+e1

medium Tenable Cloud Security Plugin ID 478475

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based
 on the issuer and serial number data contained within an X509 certificate. However it fails to correctly
 handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is
 maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a
 potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by
 OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on
 certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are
 affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x
 and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving
 public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should
 upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected
 1.0.2-1.0.2x). (CVE-2021-23841)

Solution

Update the openssl-1.0.1g library and its related packages to version 1.0.1g+e1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2021-23841

Plugin Details

Severity: Medium

ID: 478475

Version: Revision 1.1

Type: Local

Published: 11/5/2026

Updated: 11/5/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2021-23841

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/5/2026

Vulnerability Publication Date: 2/16/2021

Reference Information

CVE: CVE-2021-23841