GitHub Advisoryadvisory · crates.io

GHSA-vr8j-hgmm-jh9r Denial of service by double-checked locking in openssl-src

HIGH Published 2022-12-13 Modified 2024-10-02 Official page ↗
Aliases
CVE-2022-3996
Ecosystem
crates.io
Packages
openssl-src
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-667
Reviewed
2023-05-02

Affected packages

• crates.io openssl-src: >= 300.0.0, < 300.0.12 → fixed in 300.0.12

Description

If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy processing being enabled on a publicly facing server is not considered to be a common setup. Policy processing is enabled by passing the `-policy' argument to the command line utilities or by calling either `X509_VERIFY_PARAM_add0_policy()' or `X509_VERIFY_PARAM_set1_policies()' functions.

Related

Alias · CVE (1)

  • CVE-2022-3996 If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice… vulnerability

Weakness · CWE (1)

  • CWE-667 Improper Locking weakness

References