GitHub Advisoryadvisory · crates.io

GHSA-xphf-cx8h-7q9g `openssl` `X509StoreRef::objects` is unsound

MEDIUM Published 2023-11-28 Modified 2023-11-28 Official page ↗
Ecosystem
crates.io
Packages
openssl
Severity
Moderate
Reviewed
2023-11-28

Affected packages

• crates.io openssl: >= 0.10.29, < 0.10.60 → fixed in 0.10.60

Description

This function returned a reference into an OpenSSL datastructure, but there was no way to ensure OpenSSL would not mutate the datastructure behind one's back. Use of this function should be replaced with `X509StoreRef::all_certificates`.

References