{"id":"GHSA-xphf-cx8h-7q9g","aliases":["RUSTSEC-2023-0072"],"status":"published","title":"`openssl` `X509StoreRef::objects` is unsound","description":"This function returned a reference into an OpenSSL datastructure, but there was no way to ensure OpenSSL would not mutate the datastructure behind one's back.\n\nUse of this function should be replaced with `X509StoreRef::all_certificates`.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-11-23T12:00:00Z","modified":"2026-09-10T03:50:08Z","fixes":[{"ecosystem":"crates.io","package":"openssl","fixed_in":["0.10.60"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.29"},{"fixed":"0.10.60"}]}]},{"source":"osv","ecosystem":"crates.io","package":"openssl","ranges":[{"type":"SEMVER","events":[{"introduced":"0.10.29"},{"fixed":"0.10.60"}]}]},{"source":"osv","ecosystem":"crates.io","package":"openssl","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.10.60"}]}]}],"references":[{"url":"https://github.com/sfackler/rust-openssl/issues/2096","tags":["web","report"]},{"url":"https://github.com/sfackler/rust-openssl/commit/cf9681a55cabd4cb9f1475bde17b5079f2a0384e","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0072.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-xphf-cx8h-7q9g"},{"url":"https://github.com/sfackler/rust-openssl","tags":["package"]},{"url":"https://crates.io/crates/openssl","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-xphf-cx8h-7q9g","title":"`openssl` `X509StoreRef::objects` is unsound","description":"This function returned a reference into an OpenSSL datastructure, but there was no way to ensure OpenSSL would not mutate the datastructure behind one's back.\n\nUse of this function should be replaced with `X509StoreRef::all_certificates`.\n","status":"published","published":"2023-11-28T20:51:08Z","modified":"2023-11-28T20:51:10Z","updated_at":"2026-11-02T14:37:22.840002Z"}],"osv":[{"id":"GHSA-xphf-cx8h-7q9g","title":"`openssl` `X509StoreRef::objects` is unsound","description":"This function returned a reference into an OpenSSL datastructure, but there was no way to ensure OpenSSL would not mutate the datastructure behind one's back.\n\nUse of this function should be replaced with `X509StoreRef::all_certificates`.\n","status":"published","published":"2023-11-28T20:51:08Z","modified":"2026-09-10T03:50:08.779469678Z","updated_at":"2026-11-02T15:47:00.198893Z"},{"id":"RUSTSEC-2023-0072","title":"`openssl` `X509StoreRef::objects` is unsound","description":"This function returned a shared reference into an OpenSSL datastructure but did not account for interior mutability. OpenSSL may modify the data behind this reference, meaning accesses can race and the reference is unsound.\n\nUse of this function should be replaced with `X509StoreRef::all_certificates`.","status":"published","published":"2023-11-23T12:00:00Z","modified":"2024-02-10T16:26:49.098843Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}