GHSA-g323-fr93-4j3c CVE-2022-1473 RUSTSEC-2022-0025
Resource leakage when decoding certificates and keys
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 4.68%
- Chance of exploitation in the next 30 days. Higher than 91.78% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Fix
300.0.6- Upgrade openssl-src to this version or later
Description
The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| openssl-src | >= 300.0.0, < 300.0.6 |
300.0.6 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
openssl-src crates.io → 300.0.6
- cargo
cargo update -p openssl-src --precise 300.0.6
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-404: Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use.
How to prevent it
- Requirements: Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.
- Implementation: It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free memory in a function. If you allocate memory that you intend to free upon completion of the function, you must be sure to free the memory at all exit points for that function including error conditions.
- Implementation: Memory should be allocated/freed using matching functions such as malloc/free, new/delete, and new[]/delete[].
- Implementation: When releasing a complex object or structure, ensure that you properly dispose of all of its member components, not just the object itself.
CWE-459: Incomplete Cleanup
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
How to prevent it
- Architecture and Design, Implementation: Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.
References
Advisories
Packages
Other links
- github.com/github/advisory-database/issues/405
- cert-portal.siemens.com/productcert/pdf/ssa-953464.pdf
- git.openssl.org/gitweb
- rustsec.org/advisories/RUSTSEC-2022-0025.html
- security.gentoo.org/glsa/202210-02
- security.netapp.com/advisory/ntap-20220602-0009
- openssl.org/news/secadv/20220503.txt
- git.openssl.org/gitweb
- cert-portal.siemens.com/productcert/html/ssa-398330.html
- cert-portal.siemens.com/productcert/html/ssa-419740.html
- cert-portal.siemens.com/productcert/html/ssa-794697.html
- cert-portal.siemens.com/productcert/html/ssa-942865.html
- cert-portal.siemens.com/productcert/html/ssa-953464.html
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-w67w-mw4j-8qrv openssl-src contains Read Buffer Overflow in X.509 Name Constraint | Medium | Also affects openssl-src |
| GHSA-vrh7-x64v-7vxq openssl-src contains `NULL` dereference during PKCS7 data verification | High | Also affects openssl-src |
| GHSA-vxrh-cpg7-8vjr openssl-src subject to NULL dereference validating DSA public key | High | Also affects openssl-src |
| GHSA-r7jw-wp68-3xch openssl-src vulnerable to Use-after-free following `BIO_new_NDEF` | High | Also affects openssl-src |
| GHSA-v5w6-wcm8-jm4q openssl-src contains Double free after calling `PEM_read_bio_ex` | High | Also affects openssl-src |
| GHSA-p52g-cm5j-mjv4 openssl-src subject to Timing Oracle in RSA Decryption | Medium | Also affects openssl-src |
| GHSA-29xx-hcv2-c4cp openssl-src subject to Invalid pointer dereference in `d2i_PKCS7` functions | High | Also affects openssl-src |
| GHSA-x4qr-2fvf-3mr5 Vulnerable OpenSSL included in cryptography wheels | High | Also affects openssl-src |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor