The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2023-53159 · CVE overview and exploitation status

EUVD-2023-59771

GHSA-xcf7-rvmh-g6q4

RUSTSEC-2023-0044

cve-program · CVE-2023-53159

• https://rustsec.org/advisories/RUSTSEC-2023-0044.html
• https://github.com/sfackler/rust-openssl/issues/1965
• https://crates.io/crates/openssl

euvd · EUVD-2023-59771

• https://rustsec.org/advisories/RUSTSEC-2023-0044.html
• https://github.com/sfackler/rust-openssl/issues/1965
• https://crates.io/crates/openssl

nvd · CVE-2023-53159

• https://crates.io/crates/openssl
• https://github.com/sfackler/rust-openssl/issues/1965
• https://rustsec.org/advisories/RUSTSEC-2023-0044.html

osv · GHSA-xcf7-rvmh-g6q4

• https://nvd.nist.gov/vuln/detail/CVE-2023-53159
• https://github.com/sfackler/rust-openssl/issues/1965
• https://github.com/sfackler/rust-openssl/pull/1968
• https://github.com/sfackler/rust-openssl
• https://rustsec.org/advisories/RUSTSEC-2023-0044.html

osv · RUSTSEC-2023-0044

• https://crates.io/crates/openssl
• https://rustsec.org/advisories/RUSTSEC-2023-0044.html
• https://github.com/sfackler/rust-openssl/issues/1965

No related changes are available here.