Skip to content

chore(deps): update rust crate openssl to v0.10.79 [security]#166

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/crate-openssl-vulnerability
Open

chore(deps): update rust crate openssl to v0.10.79 [security]#166
renovate[bot] wants to merge 1 commit intomainfrom
renovate/crate-openssl-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Feb 3, 2025 •
edited
Loading

This PR contains the following updates:

Package Type Update Change
openssl dependencies patch 0.10.68 → 0.10.79

rust-openssl ssl::select_next_proto use after free

CVE-2025-24898 / GHSA-rpmj-rpgj-qmpm

More information

Details

Impact

ssl::select_next_proto can return a slice pointing into the server argument's buffer but with a lifetime bound to the client argument. In situations where the server buffer's lifetime is shorter than the client buffer's, this can cause a use after free. This could cause the server to crash or to return arbitrary memory contents to the client.

Patches

openssl 0.10.70 fixes the signature of ssl::select_next_proto to properly constrain the output buffer's lifetime to that of both input buffers.

Workarounds

In standard usage of ssl::select_next_proto in the callback passed to SslContextBuilder::set_alpn_select_callback, code is only affected if the server buffer is constructed within the callback. For example:

Not vulnerable - the server buffer has a 'static lifetime:

builder.set_alpn_select_callback(|_, client_protos| {
    ssl::select_next_proto(b"\x02h2", client_protos).ok_or_else(AlpnError::NOACK)
});

Not vulnerable - the server buffer outlives the handshake:

let server_protos = b"\x02h2".to_vec();
builder.set_alpn_select_callback(|_, client_protos| {
    ssl::select_next_proto(&server_protos, client_protos).ok_or_else(AlpnError::NOACK)
});

Vulnerable - the server buffer is freed when the callback returns:

builder.set_alpn_select_callback(|_, client_protos| {
    let server_protos = b"\x02h2".to_vec();
    ssl::select_next_proto(&server_protos, client_protos).ok_or_else(AlpnError::NOACK)
});
References

https://github.com/sfackler/rust-openssl/pull/2360

Severity

  • CVSS Score: 6.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

rust-openssl Use-After-Free in Md::fetch and Cipher::fetch

GHSA-4fcv-w3qc-ppgg

More information

Details

When a Some(...) value was passed to the properties argument of either of these functions, a use-after-free would result.

In practice this would nearly always result in OpenSSL treating the properties as an empty string (due to CString::drop's behavior).

The maintainers thank quitbug for reporting this vulnerability to us.

Severity

  • CVSS Score: 6.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check

CVE-2026-41681 / GHSA-ghm9-cr32-g9qj

More information

Details

EVP_DigestFinal() always writes EVP_MD_CTX_size(ctx) to the out buffer. If out is smaller than that, MdCtxRef::digest_final() writes past its end, usually corrupting the stack. This is reachable from safe Rust.

Severity

  • CVSS Score: 8.1 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer

CVE-2026-41898 / GHSA-hppc-g8h3-xhp3

More information

Details

The FFI trampolines behind SslContextBuilder::set_psk_client_callback, set_psk_server_callback, set_cookie_generate_cb, and set_stateless_cookie_generate_cb forwarded the user closure's returned usize directly to OpenSSL without checking it against the &mut [u8] that was handed to the closure. This can lead to buffer overflows and other unintended consequences.

Severity

  • CVSS Score: 8.3 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

rust-openssl has incorrect bounds assertion in aes key wrap

CVE-2026-41678 / GHSA-8c75-8mhr-p7r9

More information

Details

Summary

aes::unwrap_key() has an incorrect bounds assertion on the out buffer size, which can lead to out-of-bounds write.

Details

aes::unwrap_key() contains an incorrect assertion: it checks that out.len() + 8 <= in_.len(), but this condition is reversed. The intended invariant is out.len() >= in_.len() - 8, ensuring the output buffer is large enough.

Because of the inverted check, the function only accepts buffers at or below the minimum required size and rejects larger ones. If a smaller buffer is provided the function will write past the end of out by in_.len() - 8 - out.len() bytes, causing an out-of-bounds write from a safe public function.

Impact

Vulnerable applications using AES keywrap and allowing attacker controlled buffer sizes could have an attacker trigger an out-of-bounds write.

Severity

  • CVSS Score: 7.2 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length

CVE-2026-41677 / GHSA-xmgf-hq76-4vx2

More information

Details

The *_from_pem_callback APIs did not validate the length returned by the user's callback. A password callback that returns a value larger than the buffer it was given can cause some versions of OpenSSL to over-read this buffer. OpenSSL 3.x is not affected by this.

Severity

  • CVSS Score: 1.7 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1

CVE-2026-41676 / GHSA-pqf5-4pqq-29f5

More information

Details

Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL.

Severity

  • CVSS Score: 7.2 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs

CVE-2026-42327 / GHSA-xp3w-r5p5-63rr

More information

Details

X509Ref::ocsp_responders returns OCSP responder URLs from a certificate's AIA extension as OpensslString, whose Deref<Target = str> wraps the raw bytes with str::from_utf8_unchecked. OpenSSL does not enforce that the underlying IA5String is ASCII, so a certificate with non-UTF-8 bytes in its OCSP accessLocation causes safe Rust code to construct a &str that violates the UTF-8 invariant — resulting in undefined behavior.

Severity

  • CVSS Score: 8.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

rust-openssl/rust-openssl (openssl)

v0.10.79

Compare Source

What's Changed

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.78...openssl-v0.10.79

v0.10.78

Compare Source

What's Changed

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.77...openssl-v0.10.78

v0.10.77

Compare Source

What's Changed

New Contributors

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.76...openssl-v0.10.77

v0.10.76

Compare Source

What's Changed

New Contributors

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.75...openssl-v0.10.76

v0.10.75

Compare Source

What's Changed
New Contributors

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.74...openssl-v0.10.75

v0.10.74

Compare Source

What's Changed
New Contributors

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.73...openssl-v0.10.74

v0.10.73

Compare Source

What's Changed

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.72...openssl-v0.10.73

v0.10.72

Compare Source

What's Changed

New Contributors

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.71...openssl-v0.10.72

v0.10.71

Compare Source

What's Changed

New Contributors

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.70...openssl-v0.10.71

v0.10.70: openssl v0.10.70

Compare Source

What's Changed

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.69...openssl-v0.10.70

v0.10.69: openssl v0.10.69

Compare Source

What's Changed

New Contributors

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.68...openssl-v0.10.69

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot requested a review from bartvdbraak February 3, 2025 22:28
@renovate renovate Bot force-pushed the renovate/crate-openssl-vulnerability branch from c4d2efe to 698ab58 Compare April 4, 2025 22:19
@renovate renovate Bot changed the title fix(deps): update rust crate openssl to v0.10.70 [security] fix(deps): update rust crate openssl to v0.10.72 [security] Apr 4, 2025
@renovate renovate Bot force-pushed the renovate/crate-openssl-vulnerability branch from 698ab58 to 1763ec9 Compare August 10, 2025 12:44
@renovate renovate Bot changed the title fix(deps): update rust crate openssl to v0.10.72 [security] chore(deps): update rust crate openssl to v0.10.72 [security] Sep 25, 2025
@renovate renovate Bot force-pushed the renovate/crate-openssl-vulnerability branch from 1763ec9 to e5d65ad Compare December 10, 2025 11:11
@renovate renovate Bot force-pushed the renovate/crate-openssl-vulnerability branch from e5d65ad to e197728 Compare March 14, 2026 06:48
@renovate renovate Bot changed the title chore(deps): update rust crate openssl to v0.10.72 [security] chore(deps): update rust crate openssl to v0.10.72 [security] - autoclosed Mar 27, 2026
@renovate renovate Bot closed this Mar 27, 2026
@renovate renovate Bot deleted the renovate/crate-openssl-vulnerability branch March 27, 2026 05:43
@renovate renovate Bot changed the title chore(deps): update rust crate openssl to v0.10.72 [security] - autoclosed chore(deps): update rust crate openssl to v0.10.72 [security] Mar 30, 2026
@renovate renovate Bot reopened this Mar 30, 2026
@renovate renovate Bot force-pushed the renovate/crate-openssl-vulnerability branch from e197728 to b29c752 Compare March 30, 2026 21:14
@renovate renovate Bot force-pushed the renovate/crate-openssl-vulnerability branch from b29c752 to 511074d Compare April 23, 2026 02:11
@renovate renovate Bot changed the title chore(deps): update rust crate openssl to v0.10.72 [security] chore(deps): update rust crate openssl to v0.10.78 [security] Apr 23, 2026
@renovate renovate Bot changed the title chore(deps): update rust crate openssl to v0.10.78 [security] chore(deps): update rust crate openssl to v0.10.78 [security] - autoclosed Apr 27, 2026
@renovate renovate Bot closed this Apr 27, 2026
@renovate renovate Bot changed the title chore(deps): update rust crate openssl to v0.10.78 [security] - autoclosed chore(deps): update rust crate openssl to v0.10.78 [security] Apr 27, 2026
@renovate renovate Bot reopened this Apr 27, 2026
@renovate renovate Bot force-pushed the renovate/crate-openssl-vulnerability branch from 39a9151 to 511074d Compare April 27, 2026 22:04
@renovate renovate Bot force-pushed the renovate/crate-openssl-vulnerability branch from 511074d to 39a9151 Compare April 27, 2026 22:04
@renovate renovate Bot force-pushed the renovate/crate-openssl-vulnerability branch from 39a9151 to 5de0156 Compare May 6, 2026 17:50
@renovate renovate Bot changed the title chore(deps): update rust crate openssl to v0.10.78 [security] chore(deps): update rust crate openssl to v0.10.79 [security] May 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bartvdbraak bartvdbraak Awaiting requested review from bartvdbraak

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants