Data

Tools

Indexes

Applications

Experiments

Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

GSA_kwCzR0hTQS1nMzIzLWZyOTMtNGozY83dRw

High EPSS: 0.00238% (0.47096 Percentile) EPSS:
Permalink JSON

Resource leakage when decoding certificates and keys

Affected Packages Affected Versions Fixed Versions
cargo:openssl-src >= 300.0.0, < 300.0.6 300.0.6
13 Dependent packages
3,600 Dependent repositories
44,156,620 Downloads total

Affected Version Ranges

All affected versions

300.0.0, 300.0.1, 300.0.2, 300.0.3, 300.0.4, 300.0.5

All unaffected versions

110.0.0, 110.0.0, 110.0.1, 110.0.2, 110.0.3, 110.0.4, 110.0.5, 110.0.6, 110.0.7, 111.0.0, 111.0.1, 111.1.0, 111.1.1, 111.2.1, 111.3.0, 111.4.0, 111.5.0, 111.6.0, 111.6.1, 111.7.0, 111.8.0, 111.8.1, 111.9.0, 111.10.0, 111.10.1, 111.10.2, 111.11.0, 111.12.0, 111.13.0, 111.14.0, 111.15.0, 111.16.0, 111.17.0, 111.18.0, 111.19.0, 111.20.0, 111.21.0, 111.22.0, 111.23.0, 111.24.0, 111.25.0, 111.25.1, 111.25.2, 111.25.3, 111.26.0, 111.27.0, 111.28.0, 111.28.1, 111.28.2, 300.0.6, 300.0.7, 300.0.8, 300.0.9, 300.0.10, 300.0.11, 300.0.12, 300.0.13, 300.1.0, 300.1.1, 300.1.2, 300.1.3, 300.1.4, 300.1.5, 300.1.6, 300.2.0, 300.2.1, 300.2.2, 300.2.3, 300.3.0, 300.3.1, 300.3.2, 300.4.0, 300.4.1, 300.4.2, 300.5.0, 300.5.1

The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).

References:

Identifiers

GHSA-g323-fr93-4j3c

CVE-2022-1473

Risk

Severity

High

EPSS

EPSS Percentage: 0.00238

EPSS Percentile: 0.47096

Classification

General

Source

GitHub Advisory Database

Origin

Unspecified

Repository

https://github.com/github/advisory-database

Date and time

Published

about 3 years ago

Updated

almost 2 years ago

API

JSON