Buffer Overflow Affecting openssl package, versions <0.10.55


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Proof of concept

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RUST-OPENSSL-5730773
  • published22 Jun 2023
  • disclosed21 Jun 2023
  • creditDaanA32

Introduced: 21 Jun 2023

CVE NOT AVAILABLE CWE-120  (opens in a new tab)

How to fix?

Upgrade openssl to version 0.10.55 or higher.

Overview

openssl is a bindings for the Rust programming language.

Affected versions of this package are vulnerable to Buffer Overflow via the function openssl::x509::verify::X509VerifyParamRef::set_host

When this function was passed an empty string, openssl would attempt to call strlen on it, reading arbitrary memory until it reached a NUL byte.

CVSS Scores

version 3.1