MEDIUM
GHSA-3gxf-9r58-2ghg
`openssl` `X509NameBuilder::build` returned object is not thread safe
Details
OpenSSL has a `modified` bit that it can set on on `X509_NAME` objects. If this bit is set then the object is not thread-safe even when it appears the code is not modifying the value.
Thanks to David Benjamin (Google) for reporting this issue.
Are you affected?
Enter the version of the package you're using.
Affected packages
crates.io/openssl
Introduced in:
0.9.7Fixed in: 0.10.48Upgrade openssl to 0.10.48 or newer (ecosystem crates.io).