Asymmetric denial of service In openssl
Description
openssl's MemBio::get_buf has undefined behavior with empty buffers
Previously, MemBio::get_buf called slice::from_raw_parts with a null-pointer, which violates the functions invariants, leading to undefined behavior. In debug builds this would produce an assertion failure. This is now fixed.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 cargo | 0.10.66 |
Aliases
1.
References
1. 2. 3. 4.