GHSA-9qwg-crg9-m2vc RUSTSEC-2023-0023

`openssl` `SubjectAlternativeName` and `ExtendedKeyUsage::other` allow arbitrary file read

High crates.io

Severity: High; The publisher's own rating, not a CVSS score
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: 0.10.48; Upgrade openssl to this version or later

Description

SubjectAlternativeName and ExtendedKeyUsage arguments were parsed using the OpenSSL function X509V3_EXT_nconf. This function parses all input using an OpenSSL mini-language which can perform arbitrary file reads.

Thanks to David Benjamin (Google) for reporting this issue.

Affected versions

crates.io

Package	Vulnerable	Fixed in
openssl	`>= 0.9.7, < 0.10.48`	`0.10.48`
openssl	`>= 0.0.0-0, < 0.10.48`	`0.10.48`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

openssl crates.io → `0.10.48`

cargo

cargo update -p openssl --precise 0.10.48

References

Packages

Timeline

Mar 24, 2023 Published
Nov 8, 2023 Last updated by the source

Advisory	Severity	Why it's related
GHSA-phqj-4mhp-q6mq rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers	High	Also affects openssl
GHSA-xv59-967r-8726 rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding	Medium	Also affects openssl
GHSA-xp3w-r5p5-63rr rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs	High	Also affects openssl
GHSA-pqf5-4pqq-29f5 rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1	High	Also affects openssl
GHSA-xmgf-hq76-4vx2 rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length	Critical	Also affects openssl
GHSA-8c75-8mhr-p7r9 rust-openssl has incorrect bounds assertion in aes key wrap	High	Also affects openssl
GHSA-ghm9-cr32-g9qj rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check	High	Also affects openssl
GHSA-hppc-g8h3-xhp3 rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer	Medium	Also affects openssl

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor