{
  "cveId": "CVE-2021-3711",
  "url": "https://patchblox.com/security/cve/CVE-2021-3711",
  "summary": "CVE-2021-3711 is fixed in 3 products on 1 platform, first by libssl1.1 1.1.1-1ubuntu2.1~18.04.13, released August 23, 2021. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "OpenSSL: CVE-2021-3711 SM2 Decryption Buffer Overflow",
  "description": "In order to decrypt SM2 encrypted data an application is expected to callthe API function EVP_PKEY_decrypt(). Typically an application will callthis function twice. The first time, on entry, the \u0022out\u0022 parameter can beNULL and, on exit, the \u0022outlen\u0022 parameter is populated with the buffer sizerequired to hold the decrypted plaintext. The application can then allocatea sufficiently sized buffer and call EVP_PKEY_decrypt() again, but thistime passing a non-NULL value for the \u0022out\u0022 parameter. A bug in theimplementation of the SM2 decryption code means that the calculation of thebuffer size required to hold the plaintext returned by the first call toEVP_PKEY_decrypt() can be smaller than the actual size required by thesecond call. This can lead to a buffer overflow when EVP_PKEY_decrypt() iscalled by the application a second time with a buffer that is too small. Amalicious attacker who is able present SM2 content for decryption to anapplication could cause attacker chosen data to overflow the buffer by upto a maximum of 62 bytes altering the contents of other data held after thebuffer, possibly changing application behaviour or causing the applicationto crash. The location of the buffer is application dependent but istypically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).",
  "published": "2021-08-23T17:00:00Z",
  "severity": "Critical",
  "epss": 0.87816,
  "epssPercentile": 0.99763,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "exploitabilityAssessment": "Exploitation Less Likely",
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-3711",
  "fixes": [
    {
      "platform": "linux",
      "product": "libssl1.1",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1.1.1-1ubuntu2.1~18.04.13",
      "fix": "libssl1.1 1.1.1-1ubuntu2.1~18.04.13",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-libssl1.1-1.1.1-1ubuntu2.1-18.04.13",
      "released": "2021-08-23T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libssl1.1",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1.1.1f-1ubuntu2.8",
      "fix": "libssl1.1 1.1.1f-1ubuntu2.8",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-libssl1.1-1.1.1f-1ubuntu2.8",
      "released": "2021-08-23T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libssl1.1",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1.1.1l-1ubuntu1",
      "fix": "libssl1.1 1.1.1l-1ubuntu1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-libssl1.1-1.1.1l-1ubuntu1",
      "released": "2021-08-23T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libssl3t64",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "1.1.1l-1ubuntu1",
      "fix": "libssl3t64 1.1.1l-1ubuntu1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-libssl3t64-1.1.1l-1ubuntu1",
      "released": "2021-08-24T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libssl3t64",
      "release": "Ubuntu 25.04 (plucky)",
      "fixedVersion": "1.1.1l-1ubuntu1",
      "fix": "libssl3t64 1.1.1l-1ubuntu1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-libssl3t64-1.1.1l-1ubuntu1",
      "released": "2021-08-24T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1.1.1-1ubuntu2.1~18.04.13",
      "fix": "openssl 1.1.1-1ubuntu2.1~18.04.13",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-openssl-1.1.1-1ubuntu2.1-18.04.13",
      "released": "2021-08-23T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1.1.1f-1ubuntu2.8",
      "fix": "openssl 1.1.1f-1ubuntu2.8",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-openssl-1.1.1f-1ubuntu2.8",
      "released": "2021-08-23T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1.1.1l-1ubuntu1",
      "fix": "openssl 1.1.1l-1ubuntu1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-openssl-1.1.1l-1ubuntu1",
      "released": "2021-08-23T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "1.1.1l-1ubuntu1",
      "fix": "openssl 1.1.1l-1ubuntu1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-openssl-1.1.1l-1ubuntu1",
      "released": "2021-08-24T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "openssl",
      "release": "Ubuntu 25.04 (plucky)",
      "fixedVersion": "1.1.1l-1ubuntu1",
      "fix": "openssl 1.1.1l-1ubuntu1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-openssl-1.1.1l-1ubuntu1",
      "released": "2021-08-24T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}