~ / search / GHSA-29xx-hcv2-c4cp

GHSA-29xx-hcv2-c4cp

openssl-src subject to Invalid pointer dereference in `d2i_PKCS7` functions

Source: GitHub Advisory Database (reviewed) High CVE-2023-0216

Packages

EcosystemPackageAffectedFixed in
crates.io openssl-src >= 300.0.0, < 300.0.12 300.0.12

Details

As written in the advisory (Markdown source, shown as plain text).

An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the `d2i_PKCS7()`, `d2i_PKCS7_bio()` or `d2i_PKCS7_fp()` functions. The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data.

References

External links from the advisory. They lead to third-party sites.