VDB
GHSA-q445-7m23-qrmw
GHSA-q445-7m23-qrmw
PUBLISHED
CVSS 6.5 MEDIUM
openssl's `MemBio::get_buf` has undefined behavior with empty buffers
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | pixi | 0 |
| wolfi | berg | 0 |
| chainguard | sdp-k8s-injector | 0 |
| chainguard | zed | 0 |
| wolfi | lychee | 0 |
| wolfi | pixi | 0 |
| wolfi | rustup | 0 |
| wolfi | sccache | 0 |
| chainguard | rustup | 0 |
| wolfi | sdp-k8s-injector | 0 |
| chainguard | sccache | 0 |
| chainguard | lychee | 0 |
| crates.io | openssl | 0 |
| chainguard | berg | 0 |
| wolfi | zed | 0 |
Timeline
- Jul 22, 2024 CVE Published
- Sep 10, 2026 CVE Updated
References
- https://github.com/advisories/GHSA-q445-7m23-qrmw advisory
- https://github.com/sfackler/rust-openssl/pull/2266 patch
- https://github.com/sfackler/rust-openssl/commit/aef36e0f3950653148d6644309ee41ccf16e02bb patch
- https://github.com/sfackler/rust-openssl url
- https://github.com/sfackler/rust-openssl/releases/tag/openssl-v0.10.66 url
- https://rustsec.org/advisories/RUSTSEC-2024-0357.html url