Most recent entries from all

bdu:2026-14991

EUVD-2026-319040

fkie_cve-2026-42327

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocsp_responders returns OCSP responder URLs from a certificate's AIA extension as OpensslString, whose Deref<Target = str> wraps the raw bytes with str::from_utf8_unchecked. OpenSSL does not enforce that the underlying IA5String is ASCII, so a certificate with non-UTF-8 bytes in its OCSP accessLocation causes safe Rust code to construct a &str that violates the UTF-8 invariant — resulting in undefined behavior. This vulnerability is fixed in 0.10.79.

GHSA-xp3w-r5p5-63rr — rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs

Affected: crates.io: openssl

`X509Ref::ocsp_responders` returns OCSP responder URLs from a certificate's AIA extension as `OpensslString`, whose `Deref<Target = str>` wraps the raw bytes with `str::from_utf8_unchecked`. OpenSSL does not enforce that the underlying IA5String is ASCII, so a certificate with non-UTF-8 bytes in its OCSP accessLocation causes safe Rust code to construct a `&str` that violates the UTF-8 invariant — resulting in undefined behavior.

openSUSE-SU-2026:11210-1 — cargo-c-0.10.23-1.1 on GA media

cargo-c-0.10.23-1.1 on GA media

SUSE-SU-2026:22554-1 — Security update for rust-keylime

Security update for rust-keylime

UBUNTU-CVE-2026-42327

Affected: Ubuntu:Pro:20.04:LTS: rust-openssl, Ubuntu:Pro:22.04:LTS: rust-openssl, Ubuntu:Pro:24.04:LTS: rust-openssl, Ubuntu:25.10: rust-openssl, Ubuntu:26.04:LTS: rust-openssl