GHSA-hppc-g8h3-xhp3

ADVISORY - github

Summary

The FFI trampolines behind SslContextBuilder::set_psk_client_callback, set_psk_server_callback, set_cookie_generate_cb, and set_stateless_cookie_generate_cb forwarded the user closure's returned usize directly to OpenSSL without checking it against the &mut [u8] that was handed to the closure. This can lead to buffer overflows and other unintended consequences.

Common Weakness Enumeration (CWE)

ADVISORY - github

CWE-126⁠

Buffer Over-read

CWE-130⁠

Improper Handling of Length Parameter Inconsistency

Impacted images

Advisories

Sign in to Docker Scout

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.