Vulnerability MediumRUSTSEC-2021-0058 · openssl-src
RUSTSEC-2021-0058: Null pointer deref in `X509_issuer_and_serial_hash()`
Short answerA security vulnerability in the openssl-src crate: Null pointer deref in `X509_issuer_and_serial_hash()`. Medium severity (CVSS 5.9). Fixed in 111.14.0: update to a fixed version.
| Crate | openssl-src |
|---|---|
| Type | Vulnerability (denial-of-service) |
| Affected versions | Before 111.14.0. |
| Fixed in | 111.14.0 |
| Severity | Medium, CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Published | 2021-05-01 |
| Last changed | 2023-11-08 |
| Also known as | CVE-2021-23841, GHSA-84rm-qf37-fgc2 |
What to do
- See which version you have:
cargo tree -i openssl-src(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p openssl-src. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for exampleopenssl-src = "111.14.0") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack.
The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources.
References
- Package: crates.io/crates/openssl-src
- Advisory: rustsec.org/advisories/RUSTSEC-2021-0058.html
- Web: www.openssl.org/news/secadv/20210216.txt
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for openssl-src
- Vulnerability HighRUSTSEC-2020-0015 · 2020-04-25Crash causing Denial of Service attack
- Vulnerability MediumRUSTSEC-2021-0055 · 2021-05-01NULL pointer deref in signature_algorithms processing
- Vulnerability HighRUSTSEC-2021-0056 · 2021-05-01CA certificate check bypass with X509_V_FLAG_X509_STRICT
- Vulnerability HighRUSTSEC-2021-0057 · 2021-05-01Integer overflow in CipherUpdate
- Vulnerability CriticalRUSTSEC-2021-0097 · 2021-08-24SM2 Decryption Buffer Overflow
- Vulnerability HighRUSTSEC-2021-0098 · 2021-08-24Read buffer overruns processing ASN.1 strings
- VulnerabilityRUSTSEC-2021-0129 · 2021-12-14Invalid handling of `X509_verify_cert()` internal errors in libssl
- VulnerabilityRUSTSEC-2022-0014 · 2022-03-15Infinite loop in `BN_mod_sqrt()` reachable when parsing certificates
Up next
Same crateopenssl-src: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?