GitHub Advisoryadvisory · crates.io

GHSA-3gxf-9r58-2ghg `openssl` `X509NameBuilder::build` returned object is not thread safe

MEDIUM Published 2023-03-24 Modified 2023-03-24 Official page ↗
Ecosystem
crates.io
Packages
openssl
Severity
Moderate
Reviewed
2023-03-24

Affected packages

• crates.io openssl: >= 0.9.7, < 0.10.48 → fixed in 0.10.48

Description

OpenSSL has a `modified` bit that it can set on on `X509_NAME` objects. If this bit is set then the object is not thread-safe even when it appears the code is not modifying the value. Thanks to David Benjamin (Google) for reporting this issue.

References