GHSA-9qwg-crg9-m2vc

Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-9qwg-crg9-m2vc/GHSA-9qwg-crg9-m2vc.json

Published

2023-03-24T22:01:29Z

Modified

2023-03-24T22:01:29Z

Details

SubjectAlternativeName and ExtendedKeyUsage arguments were parsed using the OpenSSL function X509V3_EXT_nconf. This function parses all input using an OpenSSL mini-language which can perform arbitrary file reads.

Thanks to David Benjamin (Google) for reporting this issue.

References

• https://github.com/sfackler/rust-openssl/pull/1854
• https://github.com/sfackler/rust-openssl
• https://rustsec.org/advisories/RUSTSEC-2023-0023.html