cortex / ripasso

A simple password manager written in Rust
GNU General Public License v3.0
707 stars 61 forks source link

RUSTSEC-2023-0072: `openssl` `X509StoreRef::objects` is unsound #326

Closed github-actions[bot] closed 7 months ago

github-actions[bot] commented 7 months ago
Details
Package openssl
Version 0.10.55
Warning unsound
URL https://github.com/sfackler/rust-openssl/issues/2096
Patched Versions >=0.10.60

This function returned a shared reference into an OpenSSL datastructure but did not account for interior mutability. OpenSSL may modify the data behind this reference, meaning accesses can race and the reference is unsound.

Use of this function should be replaced with X509StoreRef::all_certificates.