GHSA-6hcf-g6gr-hhcr RUSTSEC-2023-0024

`openssl` `X509Extension::new` and `X509Extension::new_nid` null pointer dereference

High crates.io

Severity: High; The publisher's own rating, not a CVSS score
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: CWE-476 NULL Pointer Dereference
Fix: 0.10.48; Upgrade openssl to this version or later

Description

These functions would crash when the context argument was None with certain extension types.

Thanks to David Benjamin (Google) for reporting this issue.

Affected versions

crates.io

Package	Vulnerable	Fixed in
openssl	`>= 0.9.7, < 0.10.48`	`0.10.48`
openssl	`>= 0.0.0-0, < 0.10.48`	`0.10.48`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

openssl crates.io → `0.10.48`

cargo

cargo update -p openssl --precise 0.10.48

Weakness

CWE-476: NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

How to prevent it

Implementation: For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Requirements: Select a programming language that is not susceptible to these issues.
Implementation: Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
Architecture and Design: Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
Implementation: Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.

References

Packages

Timeline

Mar 24, 2023 Published
Nov 8, 2023 Last updated by the source

Advisory	Severity	Why it's related
GHSA-phqj-4mhp-q6mq rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers	High	Also affects openssl
GHSA-xv59-967r-8726 rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding	Medium	Also affects openssl
GHSA-xp3w-r5p5-63rr rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs	High	Also affects openssl
GHSA-pqf5-4pqq-29f5 rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1	High	Also affects openssl
GHSA-xmgf-hq76-4vx2 rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length	Critical	Also affects openssl
GHSA-8c75-8mhr-p7r9 rust-openssl has incorrect bounds assertion in aes key wrap	High	Also affects openssl
GHSA-ghm9-cr32-g9qj rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check	High	Also affects openssl
GHSA-hppc-g8h3-xhp3 rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer	Medium	Also affects openssl

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor