houseabsolute / ubi

The Universal Binary Installer
Apache License 2.0
190 stars 6 forks source link

RUSTSEC-2023-0044: `openssl` `X509VerifyParamRef::set_host` buffer over-read #42

Closed github-actions[bot] closed 1 year ago

github-actions[bot] commented 1 year ago
Details
Package openssl
Version 0.10.54
URL https://github.com/sfackler/rust-openssl/issues/1965
Patched Versions >=0.10.55

When this function was passed an empty string, openssl would attempt to call strlen on it, reading arbitrary memory until it reached a NUL byte.