PkgSeer

Vulnerability RUSTSEC-2026-0479

Unknown

6 months ago

Out-of-bounds read when a PEM password callback returns an oversized length

>=0.9.0 <0.10.78

Summary

Out-of-bounds read when a PEM password callback returns an oversized length

Details

The *_from_pem_callback functions, such as EcKey::private_key_from_pem_callback, pass the length returned by the user's password callback to OpenSSL without checking it against the size of the buffer the callback was given. If the callback reports more bytes than the buffer holds, some OpenSSL versions read past the end of the buffer while deriving the decryption key. OpenSSL 3.x is not affected.

0.10.78 treats a returned length larger than the buffer as a failed callback.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers

>=0.10.50 <0.10.80 GHSA-phqj-4mhp-q6mq

Buffer overflow with AES key wrap with padding in `cipher_update_inplace`

>=0.10.50 <0.10.80 RUSTSEC-2026-0477

rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding

>=0.10.0 <0.10.79 GHSA-xv59-967r-8726

rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs

>=0.9.7 <0.10.79 GHSA-xp3w-r5p5-63rr

`X509Ref::ocsp_responders` can produce a `&str` that is not valid UTF-8

>=0.9.7 <0.10.79 RUSTSEC-2026-0474

View all vulnerabilities for these packages

Impacted packages

openssl

Timeline

Published

6 months ago

Fixed (0.10.78)

6 months ago

Last Modified

14 hours ago