advisory-db/crates/openssl/RUSTSEC-2023-0024.md

[advisory]
id = "RUSTSEC-2023-0024"
package = "openssl"
date = "2023-03-24"
url = "https://github.com/sfackler/rust-openssl/pull/1854"
categories = ["denial-of-service"]
aliases = ["GHSA-6hcf-g6gr-hhcr"]

[affected]
functions = { "openssl::x509::X509Extension::new" = ["< 0.10.48, >=0.9.7"], "openssl::x509::X509Extension::new_nid" = ["< 0.10.48, >=0.9.7"] }

[versions]
patched = [">= 0.10.48"]

openssl X509Extension::new and X509Extension::new_nid null pointer dereference

These functions would crash when the context argument was None with certain extension types.

Thanks to David Benjamin (Google) for reporting this issue.