Every CVESearch/Get API key

GHSA-9qwg-crg9-m2vc

`openssl` `SubjectAlternativeName` and `ExtendedKeyUsage::other` allow arbitrary file read

No scoreFix available

GHSA-9qwg-crg9-m2vc is a vulnerability with no CVSS score yet in openssl, published March 24, 2023. No source lists public exploit code. Fixed in openssl 0.10.48.

What does this mean?
Severity
UnratedNo CVSS score yet
Exploit chance
UnscoredNo EPSS score yet
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
0.10.48openssl +1 more

Description

SubjectAlternativeName and ExtendedKeyUsage arguments were parsed using the OpenSSL function X509V3_EXT_nconf. This function parses all input using an OpenSSL mini-language which can perform arbitrary file reads.

Thanks to David Benjamin (Google) for reporting this issue.

Affected packages

Affected packages
PackageAffectedFixed
openssl
crates.io
0.9.7 up to 0.10.48
0.10.48
openssl
crates.io
0.0.0-0 up to 0.10.48
0.10.48

What each source reports

GitHub AdvisoriesNo score

`openssl` `SubjectAlternativeName` and `ExtendedKeyUsage::other` allow arbitrary file read

SubjectAlternativeName and ExtendedKeyUsage arguments were parsed using the OpenSSL function X509V3_EXT_nconf. This function parses all input using an OpenSSL mini-language which can perform arbitrary file reads.

Thanks to David Benjamin (Google) for reporting this issue.

Record
GHSA-9qwg-crg9-m2vc
Updated
2026-11-02
OSVNo score

`openssl` `SubjectAlternativeName` and `ExtendedKeyUsage::other` allow arbitrary file read

SubjectAlternativeName and ExtendedKeyUsage arguments were parsed using the OpenSSL function X509V3_EXT_nconf. This function parses all input using an OpenSSL mini-language which can perform arbitrary file reads.

Thanks to David Benjamin (Google) for reporting this issue.

Record
GHSA-9qwg-crg9-m2vc
Updated
2026-11-02
OSVRUSTSEC-2023-0023No score

`openssl` `SubjectAlternativeName` and `ExtendedKeyUsage::other` allow arbitrary file read

SubjectAlternativeName and ExtendedKeyUsage arguments were parsed using the OpenSSL function X509V3_EXT_nconf. This function parses all input using an OpenSSL mini-language which can perform arbitrary file reads.

Thanks to David Benjamin (Google) for reporting this issue.

Record
RUSTSEC-2023-0023
Updated
2026-11-02

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open