Source: rust-openssl Version: 0.10.78-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for rust-openssl. CVE-2026-42327[0]: | rust-openssl provides OpenSSL bindings for the Rust programming | language. From 0.9.7 to before 0.10.79, X509Ref::ocsp_responders | returns OCSP responder URLs from a certificate's AIA extension as | OpensslString, whose Deref<Target = str> wraps the raw bytes with | str::from_utf8_unchecked. OpenSSL does not enforce that the | underlying IA5String is ASCII, so a certificate with non-UTF-8 bytes | in its OCSP accessLocation causes safe Rust code to construct a &str | that violates the UTF-8 invariant — resulting in undefined behavior. | This vulnerability is fixed in 0.10.79. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-42327 https://www.cve.org/CVERecord?id=CVE-2026-42327 [1] https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-xp3w-r5p5-63rr Please adjust the affected versions in the BTS as needed. Regards, Salvatore
