CVE-2018-20997 — Use After Free in Project Rust-openssl

CWE-416 — Use After Free7 documents5 sources
Severity
9.8CRITICALNVD
EPSS
0.5%
top 34.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Rust-openssl Project Rust-opensslOpensslDebian Rust-openssl
Timeline
PublishedAug 26
Latest updateAug 25

Description

An issue was discovered in the openssl crate before 0.10.9 for Rust. A use-after-free occurs in CMS Signing.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶crates.ioopenssl/openssl0.10.8 — 0.10.9

🔴Vulnerability Details

4
OSV
Use after free in openssl↗2021-08-25
▶
GHSA
Use after free in openssl↗2021-08-25
▶
OSV
CVE-2018-20997: An issue was discovered in the openssl crate before 0↗2019-08-26
▶
OSV
Use after free in CMS Signing↗2018-06-01
▶

📋Vendor Advisories

1
Debian
CVE-2018-20997: rust-openssl - An issue was discovered in the openssl crate before 0.10.9 for Rust. A use-after...↗2018
▶

📄Research Papers

1
arXiv
Memory-Safety Challenge Considered Solved? An In-Depth Study with All Rust CVEs↗2021-02-25
▶
CVE-2018-20997 — Use After Free in Project Rust-openssl | cvebase