Vulnerability HighRUSTSEC-2023-0013 · openssl-src
RUSTSEC-2023-0013: `NULL` dereference during PKCS7 data verification
Short answerA security vulnerability in the openssl-src crate: `NULL` dereference during PKCS7 data verification. GitHub rates it High. Fixed in 300.0.12: update to a fixed version.
| Crate | openssl-src |
|---|---|
| Type | Vulnerability (denial-of-service) |
| Affected versions | From 300.0.0 before 300.0.12. |
| Fixed in | 300.0.12 |
| Severity | High (GitHub rating) |
| Published | 2023-02-07 |
| Last changed | 2023-11-08 |
| Also known as | CVE-2023-0401, GHSA-vrh7-x64v-7vxq |
What to do
- See which version you have:
cargo tree -i openssl-src(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p openssl-src. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for exampleopenssl-src = "300.0.12") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API most likely leading to a crash.
The unavailability of an algorithm can be caused by using FIPS enabled configuration of providers or more commonly by not loading the legacy provider.
PKCS7 data is processed by the SMIME library calls and also by the time stamp (TS) library calls. The TLS implementation in OpenSSL does not call these functions however third party applications would be affected if they call these functions to verify signatures on untrusted data.
References
- Package: crates.io/crates/openssl-src
- Advisory: rustsec.org/advisories/RUSTSEC-2023-0013.html
- Web: www.openssl.org/news/secadv/20230207.txt
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for openssl-src
- Vulnerability HighRUSTSEC-2020-0015 · 2020-04-25Crash causing Denial of Service attack
- Vulnerability MediumRUSTSEC-2021-0055 · 2021-05-01NULL pointer deref in signature_algorithms processing
- Vulnerability HighRUSTSEC-2021-0056 · 2021-05-01CA certificate check bypass with X509_V_FLAG_X509_STRICT
- Vulnerability HighRUSTSEC-2021-0057 · 2021-05-01Integer overflow in CipherUpdate
- Vulnerability MediumRUSTSEC-2021-0058 · 2021-05-01Null pointer deref in `X509_issuer_and_serial_hash()`
- Vulnerability CriticalRUSTSEC-2021-0097 · 2021-08-24SM2 Decryption Buffer Overflow
- Vulnerability HighRUSTSEC-2021-0098 · 2021-08-24Read buffer overruns processing ASN.1 strings
- VulnerabilityRUSTSEC-2021-0129 · 2021-12-14Invalid handling of `X509_verify_cert()` internal errors in libssl
Up next
Same crateopenssl-src: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?