GHSA-xphf-cx8h-7q9g: `openssl` `X509StoreRef::objects` is unsound

November 28, 2023

This function returned a reference into an OpenSSL datastructure, but there was no way to ensure OpenSSL would not mutate the datastructure behind one’s back.

Use of this function should be replaced with X509StoreRef::all_certificates.

References

github.com/advisories/GHSA-xphf-cx8h-7q9g
github.com/sfackler/rust-openssl
github.com/sfackler/rust-openssl/commit/cf9681a55cabd4cb9f1475bde17b5079f2a0384e
github.com/sfackler/rust-openssl/issues/2096
rustsec.org/advisories/RUSTSEC-2023-0072.html

Code Behaviors & Features

Detect and mitigate GHSA-xphf-cx8h-7q9g with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →