Skip to content
CVE PROGRAM SOURCE RECORD3.7 Low

CVE-2025-3416

Rust-openssl: rust-openssl use-after-free in `md::fetch` and `cipher::fetch`

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

rust-openssl

Default version status: unaffected

  • 0.10.39 to < 0.10.72affected

Red Hat Red Hat Directory Server 11

Default version status: affected

Red Hat Red Hat Directory Server 12

Default version status: affected

Red Hat Red Hat Enterprise Linux 10

Default version status: affected

Red Hat Red Hat Enterprise Linux 10

Default version status: affected

Red Hat Red Hat Enterprise Linux 10

Default version status: affected

Red Hat Red Hat Enterprise Linux 6

Default version status: affected

Red Hat Red Hat Enterprise Linux 7

Default version status: affected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: affected

Red Hat Red Hat OpenShift Container Platform 4

Default version status: affected

Red Hat Red Hat Trusted Artifact Signer

Default version status: affected

Red Hat Red Hat Trusted Artifact Signer

Default version status: affected

Red Hat Red Hat Trusted Profile Analyzer

Default version status: affected

References