HIGH
GHSA-9qwg-crg9-m2vc
`openssl` `SubjectAlternativeName` and `ExtendedKeyUsage::other` allow arbitrary file read
Details
`SubjectAlternativeName` and `ExtendedKeyUsage` arguments were parsed using the OpenSSL function `X509V3_EXT_nconf`. This function parses all input using an OpenSSL mini-language which can perform arbitrary file reads.
Thanks to David Benjamin (Google) for reporting this issue.
Are you affected?
Enter the version of the package you're using.
Affected packages
crates.io/openssl
Introduced in:
0.9.7Fixed in: 0.10.48Upgrade openssl to 0.10.48 or newer (ecosystem crates.io).