CVE-2023-53159: Critical severity OpenSSL openssl crate vulnerability
The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::sethost.
Other sources
When this function was passed an empty string, openssl would attempt to call strlen on it, reading arbitrary memory until it reached a NUL byte.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/opensslto a version that resolves this vulnerability.Fixed in 0.10.55
Event History
Frequently Asked Questions
What is the severity of CVE-2023-53159?
CVE-2023-53159 is classified as a medium severity vulnerability due to the possibility of an out-of-bounds read.
How do I fix CVE-2023-53159?
To resolve CVE-2023-53159, update the openssl crate to version 0.10.55 or higher.
Who is affected by CVE-2023-53159?
CVE-2023-53159 affects users of the openssl crate in Rust versions prior to 0.10.55.
What kind of exploit is associated with CVE-2023-53159?
CVE-2023-53159 involves an out-of-bounds read that can occur when an empty string is passed to X509VerifyParamRef::set_host.
Can CVE-2023-53159 lead to data leakage?
Yes, CVE-2023-53159 could potentially lead to data leakage due to its out-of-bounds read characteristics.