Use After Free Affecting openssl package, versions >=0.10.0 <0.10.70
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-OPENSSL-8687894
- published4 Feb 2025
- disclosed3 Feb 2025
- creditMatt Mastracci
Introduced: 3 Feb 2025
CVE-2025-24898 (opens in a new tab)How to fix?
Upgrade openssl to version 0.10.70 or higher.
Overview
openssl is a bindings for the Rust programming language.
Affected versions of this package are vulnerable to Use After Free via the ssl::select_next_proto function. An attacker can cause the server to crash or to return arbitrary memory contents to the client by exploiting the lifetime mismatch between the server and client buffers.
Note:
This is only exploitable if the server buffer is constructed within the callback and freed when the callback returns.
Workaround
This vulnerability can be mitigated by ensuring that the server buffer either has a 'static lifetime or outlives the handshake.