From 929acd512d8883e2221859ed090ff1124be32bc9 Mon Sep 17 00:00:00 2001 From: Paul Kehrer Date: Fri, 24 Mar 2023 10:20:39 +0800 Subject: [PATCH] openssl X509NameBuilder::build thread safety (#1654) * openssl X509NameBuilder::build thread safety * Update crates/openssl/RUSTSEC-0000-0000.md Co-authored-by: Alex Gaynor --------- Co-authored-by: Alex Gaynor --- crates/openssl/RUSTSEC-0000-0000.md | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 crates/openssl/RUSTSEC-0000-0000.md diff --git a/crates/openssl/RUSTSEC-0000-0000.md b/crates/openssl/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..1601ab9 --- /dev/null +++ b/crates/openssl/RUSTSEC-0000-0000.md @@ -0,0 +1,22 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "openssl" +date = "2023-03-24" +url = "https://github.com/sfackler/rust-openssl/pull/1854" +categories = ["thread-safety"] + +[affected] +functions = { "openssl::x509::X509NameBuilder::build" = ["< 0.10.48, >=0.9.7"] } + +[versions] +patched = [">= 0.10.48"] +``` + +# `openssl` `X509NameBuilder::build` returned object is not thread safe + +OpenSSL has a `modified` bit that it can set on on `X509_NAME` objects. If this +bit is set then the object is not thread-safe even when it appears the code is +not modifying the value. + +Thanks to David Benjamin (Google) for reporting this issue.