github.com
https://github.com/sfackler/rust-openssl GHSA-4FCV-W3QC-PPGG
rust-openssl Use-After-Free in `Md::fetch` and `Cipher::fetch`
Description
When a `Some(...)` value was passed to the `properties` argument of either of these functions, a use-after-free would result. In practice this would nearly always result in OpenSSL treating the properties as an empty string (due to `CString::drop`'s behavior). The maintainers thank [quitbug](https://github.com/quitbug/) for reporting this vulnerability to us.
Description source: GitHub Advisory
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
opensslBrowse crates.io / openssl | GitHub Advisory | 0.10.39 to < 0.10.72 · Fixed in 0.10.72 | affected |
References
4github.com
https://github.com/sfackler/rust-openssl/commit/87085bd67896b7f92e6de35d081f607a334beae4 github.com
https://github.com/sfackler/rust-openssl/pull/2390 rustsec.org
https://rustsec.org/advisories/RUSTSEC-2025-0022.html