GitHub Advisoryadvisory · crates.io
GHSA-xcf7-rvmh-g6q4 `openssl` `X509VerifyParamRef::set_host` buffer over-read
MEDIUM
Official page ↗
- Aliases
- CVE-2023-53159
- Ecosystem
- crates.io
- Packages
- openssl
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L
- Weaknesses
- CWE-126
- Reviewed
- 2023-06-21
Affected packages
• crates.io openssl: >= 0.10.0, < 0.10.55 → fixed in 0.10.55
Description
When this function was passed an empty string, `openssl` would attempt to call `strlen` on it, reading arbitrary memory until it reached a NUL byte.
Related
Alias · CVE (1)
- CVE-2023-53159 The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host. vulnerability
Weakness · CWE (1)
- CWE-126 Buffer Over-read weakness