—
RUSTSEC-2025-0022
Use-After-Free in `Md::fetch` and `Cipher::fetch`
Details
When a `Some(...)` value was passed to the `properties` argument of either of these functions, a use-after-free would result.
In practice this would nearly always result in OpenSSL treating the properties as an empty string (due to `CString::drop`'s behavior).
The maintainers thank [quitbug](https://github.com/quitbug/) for reporting this vulnerability to us.
Are you affected?
Enter the version of the package you're using.
Affected packages
crates.io/openssl
Introduced in:
0.10.39Fixed in: 0.10.72Upgrade openssl to 0.10.72 or newer (ecosystem crates.io).