openssl (crates.io)
Advisories
29
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 0.10.80 or later clears every advisory below that has a fix.
Upgrade commands
cargo
cargo update -p openssl --precise 0.10.80Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-phqj-4mhp-q6mq rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers |
High EPSS 0.13% |
>= 0.10.50, < 0.10.80 | 0.10.80 |
| GHSA-xv59-967r-8726 rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding |
Medium EPSS 0.17% |
>= 0.10.0, < 0.10.79 | 0.10.79 |
| GHSA-xp3w-r5p5-63rr rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs |
High EPSS 0.21% |
>= 0.9.7, < 0.10.79 | 0.10.79 |
| GHSA-pqf5-4pqq-29f5 rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1 |
High EPSS 0.29% |
>= 0.9.27, < 0.10.78 | 0.10.78 |
| GHSA-xmgf-hq76-4vx2 rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length |
Critical EPSS 0.29% |
>= 0.9.0, < 0.10.78 | 0.10.78 |
| GHSA-8c75-8mhr-p7r9 rust-openssl has incorrect bounds assertion in aes key wrap |
High EPSS 0.25% |
>= 0.10.24, < 0.10.78 | 0.10.78 |
| GHSA-ghm9-cr32-g9qj rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check |
High EPSS 0.36% |
>= 0.10.39, < 0.10.78 | 0.10.78 |
| GHSA-hppc-g8h3-xhp3 rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer |
Medium EPSS 0.28% |
>= 0.9.24, < 0.10.78 | 0.10.78 |
| GHSA-gw89-822v-8v8g Duplicate Advisory: `openssl` `X509VerifyParamRef::set_host` buffer over-read Withdrawn |
Medium | >= 0.10.0, < 0.10.55 | 0.10.55 |
| GHSA-4fcv-w3qc-ppgg rust-openssl Use-After-Free in `Md::fetch` and `Cipher::fetch` |
Medium | >= 0.10.39, < 0.10.72 | 0.10.72 |
| GHSA-4fcv-w3qc-ppgg rust-openssl Use-After-Free in `Md::fetch` and `Cipher::fetch` |
Medium | >= 0.10.39, < 0.10.72 | 0.10.72 |
| GHSA-rpmj-rpgj-qmpm rust-openssl ssl::select_next_proto use after free |
Medium EPSS 0.68% |
>= 0.10.0, < 0.10.70 | 0.10.70 |
| GHSA-rpmj-rpgj-qmpm rust-openssl ssl::select_next_proto use after free |
Medium EPSS 0.68% |
>= 0.0.0-0, < 0.10.70 | 0.10.70 |
| GHSA-q445-7m23-qrmw openssl's `MemBio::get_buf` has undefined behavior with empty buffers |
Medium | < 0.10.66 | 0.10.66 |
| GHSA-q445-7m23-qrmw openssl's `MemBio::get_buf` has undefined behavior with empty buffers |
Medium | >= 0.0.0-0, < 0.10.66 | 0.10.66 |
| GHSA-xphf-cx8h-7q9g `openssl` `X509StoreRef::objects` is unsound |
Medium | >= 0.10.29, < 0.10.60 | 0.10.60 |
| GHSA-xphf-cx8h-7q9g `openssl` `X509StoreRef::objects` is unsound |
Medium | >= 0.0.0-0, < 0.10.60 | 0.10.60 |
| GHSA-xcf7-rvmh-g6q4 `openssl` `X509VerifyParamRef::set_host` buffer over-read |
Low EPSS 0.23% |
>= 0.0.0-0, < 0.10.55 | 0.10.55 |
| GHSA-xcf7-rvmh-g6q4 `openssl` `X509VerifyParamRef::set_host` buffer over-read |
Low EPSS 0.23% |
>= 0.10.0, < 0.10.55 | 0.10.55 |
| GHSA-3gxf-9r58-2ghg `openssl` `X509NameBuilder::build` returned object is not thread safe |
Medium | >= 0.9.7, < 0.10.48 | 0.10.48 |
| GHSA-9qwg-crg9-m2vc `openssl` `SubjectAlternativeName` and `ExtendedKeyUsage::other` allow arbitrary file read |
High | >= 0.0.0-0, < 0.10.48 | 0.10.48 |
| GHSA-9qwg-crg9-m2vc `openssl` `SubjectAlternativeName` and `ExtendedKeyUsage::other` allow arbitrary file read |
High | >= 0.9.7, < 0.10.48 | 0.10.48 |
| GHSA-6hcf-g6gr-hhcr `openssl` `X509Extension::new` and `X509Extension::new_nid` null pointer dereference |
High | >= 0.0.0-0, < 0.10.48 | 0.10.48 |
| GHSA-6hcf-g6gr-hhcr `openssl` `X509Extension::new` and `X509Extension::new_nid` null pointer dereference |
High | >= 0.9.7, < 0.10.48 | 0.10.48 |
| GHSA-3gxf-9r58-2ghg `openssl` `X509NameBuilder::build` returned object is not thread safe |
Medium | >= 0.0.0-0, < 0.10.48 | 0.10.48 |
| GHSA-xjxc-vfw2-cg96 Use after free in openssl |
Critical EPSS 1.74% |
>= 0.10.8, < 0.10.9 | 0.10.9 |
| GHSA-xjxc-vfw2-cg96 Use after free in openssl |
Critical EPSS 1.74% |
>= 0.10.8, < 0.10.9 | 0.10.9 |
| GHSA-34p9-f4q3-c4r7 Improper Certificate Validation in openssl |
High EPSS 0.74% |
< 0.9.0 | 0.9.0 |
| GHSA-34p9-f4q3-c4r7 Improper Certificate Validation in openssl |
High EPSS 0.74% |
>= 0.0.0-0, < 0.9.0 | 0.9.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor