RUSTSEC-2023-0011

Source
https://rustsec.org/advisories/RUSTSEC-2023-0011
Import Source
https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2023-0011.json
Aliases
Published
2023-02-07T12:00:00Z
Modified
2023-11-08T04:11:06.322448Z
Summary
Invalid pointer dereference in `d2i_PKCS7` functions
Details

An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions.

The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data.

References

Affected packages

crates.io / openssl-src

Package

Name
openssl-src

Affected ranges

Type
SEMVER
Events
Introduced
300.0.0
Fixed
300.0.12

Ecosystem specific 

{
    "affected_functions": null,
    "affects": {
        "os": [],
        "functions": [],
        "arch": []
    }
}

Database specific 

{
    "cvss": null,
    "informational": null,
    "categories": [
        "denial-of-service"
    ]
}