RUSTSEC-2023-0011

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2023-0011

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2023-0011.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2023-0011

Aliases

Published

2023-02-07T12:00:00Z

Modified

2023-11-08T04:11:06.322448Z

Summary

Invalid pointer dereference in `d2i_PKCS7` functions

Details

An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions.

The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data.

References

Affected packages

crates.io / openssl-src

Package

Name: openssl-src; View open source insights on deps.dev
Purl: pkg:cargo/openssl-src

Affected ranges

Type: SEMVER
Events: Introduced

300.0.0

Fixed

300.0.12

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "os": [],
        "functions": [],
        "arch": []
    }
}

Database specific

{
    "cvss": null,
    "informational": null,
    "categories": [
        "denial-of-service"
    ]
}