OMGeeky/advisory-db
1
0
Fork 0
mirror of https://github.com/OMGeeky/advisory-db.git synced 2026-01-08 04:27:11 +01:00
Code Issues Packages Projects Releases Wiki Activity

openssl X509NameBuilder::build thread safety (#1654)

Browse Source 
* openssl X509NameBuilder::build thread safety

* Update crates/openssl/RUSTSEC-0000-0000.md

Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>

---------

Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
This commit is contained in:
Paul Kehrer
2023-03-24 10:20:39 +08:00
committed by GitHub
parent 7fcf849f8d
commit 929acd512d
1 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
crates/openssl/RUSTSEC-0000-0000.md Normal file
View File

@@ -0,0 +1,22 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "openssl"
date = "2023-03-24"
url = "https://github.com/sfackler/rust-openssl/pull/1854"
categories = ["thread-safety"]
[affected]
functions = { "openssl::x509::X509NameBuilder::build" = ["< 0.10.48, >=0.9.7"] }
[versions]
patched = [">= 0.10.48"]
```
# `openssl` `X509NameBuilder::build` returned object is not thread safe
OpenSSL has a `modified` bit that it can set on on `X509_NAME` objects. If this
bit is set then the object is not thread-safe even when it appears the code is
not modifying the value.
Thanks to David Benjamin (Google) for reporting this issue.