rust openssl ssl::select_next_proto use after free
Résumé
rust openssl ssl::select_next_proto use after free
Description d'origine
La description telle que publiée par la source (souvent en anglais).
rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions ssl::select_next_proto can return a slice pointing into the server argument's buffer but with a lifetime bound to the client argument. In situations where the sever buffer's lifetime is shorter than the client buffer's, this can cause a use after free. This could cause the server to crash or to return arbitrary memory contents to the client. The crateopenssl version 0.10.70 fixes the signature of ssl::select_next_proto to properly constrain the output buffer's lifetime to that of both input buffers. Users are advised to upgrade. In standard usage of ssl::select_next_proto in the callback passed to SslContextBuilder::set_alpn_select_callback, code is only affected if the server buffer is constructed within the callback.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2025-24898 rust-openssl Corrigé dans: 0.10.29-1+deb11u1
Références
- advisory rustsec.org
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web crates.io
- web lists.debian.org