GHSA-9qwg-crg9-m2vc `openssl` `SubjectAlternativeName` and `ExtendedKeyUsage::other` allow arbitrary file read
Attackers can read arbitrary files by exploiting unsafe parsing of certificate extensions in the Rust openssl crate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-9qwg-crg9-m2vc?
GHSA-9qwg-crg9-m2vc is a path traversal vulnerability in openssl, published on 24 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SubjectAlternativeName and ExtendedKeyUsage arguments were parsed using the OpenSSL function X509V3_EXT_nconf. This function parses all input using an OpenSSL mini-language which can perform arbitrary file reads.
Thanks to David Benjamin (Google) for reporting this issue.
Which versions are affected by GHSA-9qwg-crg9-m2vc?
3 open source packages ship an affected version, including openssl.
| Package | Affected | Fixed in |
|---|---|---|
openssl crates.io | From 0.0.0-0 | 0.10.48 |
openssl crates.io | From 0.9.7 | 0.10.48 |
openssl crates.io | From 0.9.7 | 0.10.48 |
How do I fix GHSA-9qwg-crg9-m2vc?
Upgrade openssl to 0.10.48 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is GHSA-9qwg-crg9-m2vc being exploited?
There is no known exploitation of GHSA-9qwg-crg9-m2vc in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2023-0023.