sfackler/rust-openssl · Security
`openssl` `X509VerifyParamRef::set_host` buffer over-read
- GHSA ID
- GHSA-xcf7-rvmh-g6q4
- CVE ID
- CVE-2023-53159
- Severity
- medium
- Published
- Updated
- CVSS
- 4.5 · CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L
- CVSS v3
- 4.5 · CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L
Description
When this function was passed an empty string, openssl would attempt to call strlen on it, reading arbitrary memory until it reached a NUL byte.
CWEs
- CWE-126 · Buffer Over-read