Echo: openssl-1.1.1c: security update to 1.1.1c+e1openssl-1.1.1g: security update to 1.1.1g+e1

high Tenable Self-Hosted Container Security Plugin ID 478443

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument
in some cases where the input length is close to the maximum permissable length for an integer on the
platform. In such cases the return value from the function call will be 1 (indicating success), but the
output length value will be negative. This could cause applications to behave incorrectly or crash.
OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to
OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out
of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should
upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i).
Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). (CVE-2021-23840)

Solution

Update the openssl-1.1.1c library and its related packages to version 1.1.1c+e1 or later.

Plugin Details

Severity: High

ID: 478443

Version: Revision 1.1

Type: Local

Family: Echo Local Security Checks

Published: 11/5/2026

Updated: 11/5/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.69

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2021-23840

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/5/2026

Vulnerability Publication Date: 2/16/2021

Reference Information

CVE: CVE-2021-23840

Detections

Analytics