~ / search / GHSA-xcf7-rvmh-g6q4

GHSA-xcf7-rvmh-g6q4

`openssl` `X509VerifyParamRef::set_host` buffer over-read

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-53159

Packages

EcosystemPackageAffectedFixed in
crates.io openssl >= 0.10.0, < 0.10.55 0.10.55

Details

As written in the advisory (Markdown source, shown as plain text).

When this function was passed an empty string, `openssl` would attempt to call `strlen` on it, reading arbitrary memory until it reached a NUL byte.

References

External links from the advisory. They lead to third-party sites.