GHSA-xphf-cx8h-7q9g `openssl` `X509StoreRef::objects` is unsound
Unsound reference handling in Rust OpenSSL bindings allows race conditions, potentially leading to memory corruption or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-xphf-cx8h-7q9g?
GHSA-xphf-cx8h-7q9g is a vulnerability in openssl, published on 23 Nov 2023.
Official description
This function returned a shared reference into an OpenSSL datastructure but did not account for interior mutability. OpenSSL may modify the data behind this reference, meaning accesses can race and the reference is unsound.
Use of this function should be replaced with X509StoreRef::all_certificates.
Which versions are affected by GHSA-xphf-cx8h-7q9g?
3 open source packages ship an affected version, including openssl.
| Package | Affected | Fixed in |
|---|---|---|
openssl crates.io | From 0.0.0-0 | 0.10.60 |
openssl crates.io | From 0.10.29 | 0.10.60 |
openssl crates.io | From 0.10.29 | 0.10.60 |
How do I fix GHSA-xphf-cx8h-7q9g?
Upgrade openssl to 0.10.60 or later.
Is GHSA-xphf-cx8h-7q9g being exploited?
There is no known exploitation of GHSA-xphf-cx8h-7q9g in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2023-0072.