Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS12cjhqLWhnbW0tamg5cs4AAwTC

openssl-src subject to DoS by double-checked locking

If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy processing being enabled on a publicly facing server is not considered to be a common setup. Policy processing is enabled by passing the -policy' argument to the command line utilities or by calling either X509_VERIFY_PARAM_add0_policy()' or `X509_VERIFY_PARAM_set1_policies()' functions.

Permalink: https://github.com/advisories/GHSA-vr8j-hgmm-jh9r
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12cjhqLWhnbW0tamg5cs4AAwTC
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 1 year ago
Updated: 12 months ago


CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-vr8j-hgmm-jh9r, CVE-2022-3996
References: Repository: https://github.com/openssl/openssl
Blast Radius: 26.7

Affected Packages

cargo:openssl-src
Dependent packages: 9
Dependent repositories: 3,600
Downloads: 18,993,906 total
Affected Version Ranges: >= 3.0.0, < 3.0.8
Fixed in: 3.0.8
All affected versions:
All unaffected versions: 110.0.0, 110.0.0, 110.0.1, 110.0.2, 110.0.3, 110.0.4, 110.0.5, 110.0.6, 110.0.7, 111.0.0, 111.0.1, 111.1.0, 111.1.1, 111.2.1, 111.3.0, 111.4.0, 111.5.0, 111.6.0, 111.6.1, 111.7.0, 111.8.0, 111.8.1, 111.9.0, 111.10.0, 111.10.1, 111.10.2, 111.11.0, 111.12.0, 111.13.0, 111.14.0, 111.15.0, 111.16.0, 111.17.0, 111.18.0, 111.19.0, 111.20.0, 111.21.0, 111.22.0, 111.23.0, 111.24.0, 111.25.0, 111.25.1, 111.25.2, 111.25.3, 111.26.0, 111.27.0, 111.28.0, 111.28.1, 300.0.0, 300.0.1, 300.0.2, 300.0.3, 300.0.4, 300.0.5, 300.0.6, 300.0.7, 300.0.8, 300.0.9, 300.0.10, 300.0.11, 300.0.12, 300.0.13, 300.1.0, 300.1.1, 300.1.2, 300.1.3, 300.1.4, 300.1.5, 300.1.6, 300.2.0, 300.2.1, 300.2.2, 300.2.3