GHSA-xphf-cx8h-7q9g
`openssl` `X509StoreRef::objects` is unsound
GHSA-xphf-cx8h-7q9g is a vulnerability with no CVSS score yet in openssl, published November 23, 2023. No source lists public exploit code. Fixed in openssl 0.10.60.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.10.60openssl +1 more
Description
This function returned a reference into an OpenSSL datastructure, but there was no way to ensure OpenSSL would not mutate the datastructure behind one's back.
Use of this function should be replaced with X509StoreRef::all_certificates.
Affected packages
What each source reports
GitHub AdvisoriesNo score
`openssl` `X509StoreRef::objects` is unsound
This function returned a reference into an OpenSSL datastructure, but there was no way to ensure OpenSSL would not mutate the datastructure behind one's back.
Use of this function should be replaced with X509StoreRef::all_certificates.
- Record
GHSA-xphf-cx8h-7q9g- Updated
- 2026-11-02
OSVNo score
`openssl` `X509StoreRef::objects` is unsound
This function returned a reference into an OpenSSL datastructure, but there was no way to ensure OpenSSL would not mutate the datastructure behind one's back.
Use of this function should be replaced with X509StoreRef::all_certificates.
- Record
GHSA-xphf-cx8h-7q9g- Updated
- 2026-11-02
OSVRUSTSEC-2023-0072No score
`openssl` `X509StoreRef::objects` is unsound
This function returned a shared reference into an OpenSSL datastructure but did not account for interior mutability. OpenSSL may modify the data behind this reference, meaning accesses can race and the reference is unsound.
Use of this function should be replaced with X509StoreRef::all_certificates.
- Record
RUSTSEC-2023-0072- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.