GHSA-3gxf-9r58-2ghg `openssl` `X509NameBuilder::build` returned object is not thread safe
A race condition in the Rust OpenSSL bindings' X509NameBuilder can lead to memory corruption or crashes when used concurrently.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-3gxf-9r58-2ghg?
GHSA-3gxf-9r58-2ghg is a vulnerability in openssl, published on 24 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenSSL has a modified bit that it can set on on X509_NAME objects. If this bit is set then the object is not thread-safe even when it appears the code is not modifying the value.
Thanks to David Benjamin (Google) for reporting this issue.
Which versions are affected by GHSA-3gxf-9r58-2ghg?
3 open source packages ship an affected version, including openssl.
| Package | Affected | Fixed in |
|---|---|---|
openssl crates.io | From 0.0.0-0 | 0.10.48 |
openssl crates.io | From 0.9.7 | 0.10.48 |
openssl crates.io | From 0.9.7 | 0.10.48 |
How do I fix GHSA-3gxf-9r58-2ghg?
Upgrade openssl to 0.10.48 or later.
Is GHSA-3gxf-9r58-2ghg being exploited?
There is no known exploitation of GHSA-3gxf-9r58-2ghg in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2023-0022.