Rust-openssl Project rust-OpenSSL

An issue was discovered in the openssl crate before 0.10.9 for Rust. A use-after-free occurs in CMS Signing.

rust-openssl: Out-of-bounds read in PEM password callback when user callback returns an oversized length

rust-openssl: Unchecked callback-returned length in PSK and cookie generate trampolines can cause OpenSSL to leak adjacent memory to the network peer

An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification.

rust-openssl: MdCtxRef::digest_final() writes past caller buffer with no length check

rust-openssl: Incorrect bounds assertion in aes key wrap

rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1