1 line
1.5 KiB
JSON
1 line
1.5 KiB
JSON
{"schema_version":"1.9.2","id":"RUSTSEC-2026-0477","published":"2026-05-16T12:00:00Z","modified":"2026-11-10T14:00:02.477702931Z","aliases":["CVE-2026-45784","GHSA-phqj-4mhp-q6mq"],"summary":"Buffer overflow with AES key wrap with padding in `cipher_update_inplace`","details":"`CipherCtxRef::cipher_update_inplace` had the same sizing error that 0.10.79 fixed in `cipher_update` (GHSA-xv59-967r-8726); that fix missed this method. It required room for `inlen + block_size` bytes, but with the AES key-wrap-with-padding ciphers OpenSSL writes up to 7 more bytes when `inlen` is not a multiple of 8, past the end of `data`.\n\nOnly users of the AES key-wrap-with-padding ciphers are affected. `cipher_update_inplace` was added in 0.10.50, and 0.10.80 applies the corrected size check to it.","affected":[{"package":{"name":"openssl","ecosystem":"crates.io","purl":"pkg:cargo/openssl"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.10.50"},{"fixed":"0.10.80"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":["openssl::cipher_ctx::CipherCtxRef::cipher_update_inplace"],"os":[]}},"database_specific":{"categories":["memory-corruption"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0477.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/openssl"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0477.html"},{"type":"WEB","url":"https://github.com/rust-openssl/rust-openssl/pull/2638"}],"database_specific":{"license":"CC0-1.0"}} |