PkgSeer

Vulnerability RUSTSEC-2026-0477

Unknown

5 months ago

Buffer overflow with AES key wrap with padding in `cipher_update_inplace`

>=0.10.50 <0.10.80

Summary

Buffer overflow with AES key wrap with padding in `cipher_update_inplace`

Details

CipherCtxRef::cipher_update_inplace had the same sizing error that 0.10.79 fixed in cipher_update (GHSA-xv59-967r-8726); that fix missed this method. It required room for inlen + block_size bytes, but with the AES key-wrap-with-padding ciphers OpenSSL writes up to 7 more bytes when inlen is not a multiple of 8, past the end of data.

Only users of the AES key-wrap-with-padding ciphers are affected. cipher_update_inplace was added in 0.10.50, and 0.10.80 applies the corrected size check to it.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers

>=0.10.50 <0.10.80 GHSA-phqj-4mhp-q6mq

rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding

>=0.10.0 <0.10.79 GHSA-xv59-967r-8726

rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs

>=0.9.7 <0.10.79 GHSA-xp3w-r5p5-63rr

`X509Ref::ocsp_responders` can produce a `&str` that is not valid UTF-8

>=0.9.7 <0.10.79 RUSTSEC-2026-0474

Buffer overflow with AES key wrap with padding in `cipher_update`

>=0.10.0 <0.10.79 RUSTSEC-2026-0476

View all vulnerabilities for these packages

Impacted packages

openssl

Timeline

Published

5 months ago

Fixed (0.10.80)

5 months ago

Last Modified

14 hours ago