GHSA-29xx-hcv2-c4cpHighCVSS 7.5

openssl-src subject to Invalid pointer dereference in `d2i_PKCS7` functions

Published
February 8, 2023
Last Modified
November 4, 2025

🔗 CVE IDs covered (1)

CVE-2023-0216 →

📋 Description

An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions.

The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data.

🎯 Affected products1

  • rust/openssl-src:>= 300.0.0, < 300.0.12

🔗 References (7)