Lucene search

K
rustsecRustsecRUSTSEC-2022-0025
HistoryMay 03, 2022 - 12:00 p.m.

Resource leakage when decoding certificates and keys

2022-05-0312:00:00
rustsec.org
11

0.003 Low

EPSS

Percentile

69.2%

The OPENSSL_LH_flush() function, which empties a hash table, contains
a bug that breaks reuse of the memory occupied by the removed hash
table entries.

This function is used when decoding certificates or keys. If a long lived
process periodically decodes certificates or keys its memory usage will
expand without bounds and the process might be terminated by the operating
system causing a denial of service. Also traversing the empty hash table
entries will take increasingly more time.

Typically such long lived processes might be TLS clients or TLS servers
configured to accept client certificate authentication.

CPENameOperatorVersion
openssl-srcge300.0.0
openssl-srclt300.0.6