GHSA-xphf-cx8h-7q9g RUSTSEC-2023-0072
`openssl` `X509StoreRef::objects` is unsound
- Severity
- Medium
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
0.10.60- Upgrade openssl to this version or later
Description
This function returned a reference into an OpenSSL datastructure, but there was no way to ensure OpenSSL would not mutate the datastructure behind one's back.
Use of this function should be replaced with X509StoreRef::all_certificates.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| openssl | >= 0.10.29, < 0.10.60 |
0.10.60 |
| openssl | >= 0.0.0-0, < 0.10.60 |
0.10.60 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
openssl crates.io → 0.10.60
- cargo
cargo update -p openssl --precise 0.10.60
References
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-phqj-4mhp-q6mq rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers | High | Also affects openssl |
| GHSA-xv59-967r-8726 rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding | Medium | Also affects openssl |
| GHSA-xp3w-r5p5-63rr rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs | High | Also affects openssl |
| GHSA-pqf5-4pqq-29f5 rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1 | High | Also affects openssl |
| GHSA-xmgf-hq76-4vx2 rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length | Critical | Also affects openssl |
| GHSA-8c75-8mhr-p7r9 rust-openssl has incorrect bounds assertion in aes key wrap | High | Also affects openssl |
| GHSA-ghm9-cr32-g9qj rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check | High | Also affects openssl |
| GHSA-hppc-g8h3-xhp3 rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer | Medium | Also affects openssl |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor