GHSA-vr8j-hgmm-jh9r

Suggest an improvement
Source
https://github.com/advisories/GHSA-vr8j-hgmm-jh9r
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-vr8j-hgmm-jh9r/GHSA-vr8j-hgmm-jh9r.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-vr8j-hgmm-jh9r
Aliases
Published
2022-12-13T18:30:33Z
Modified
2023-11-08T04:10:21.631374Z
Severity
  • CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
openssl-src subject to DoS by double-checked locking
Details

If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy processing being enabled on a publicly facing server is not considered to be a common setup. Policy processing is enabled by passing the -policy' argument to the command line utilities or by calling eitherX509VERIFYPARAMadd0policy()' or `X509VERIFYPARAMset1policies()' functions.

References

Affected packages

crates.io / openssl-src

Package

Affected ranges

Type
SEMVER
Events
Introduced
3.0.0
Fixed
3.0.8