CVE-2023-53159 — Buffer Over-read in Openssl

CWE-126 — Buffer Over-read9 documents7 sources
Severity
9.1CRITICALNVD
EPSS
0.1%
top 78.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Rust-openssl Project Rust-opensslSfackler OpensslOpenssl+4 more
Timeline
PublishedJul 28
Latest updateNov 26

Description

The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HExploitability: 3.9 | Impact: 5.2

Affected Packages8 packages

▶debiandebian/rust-openssl< rust-openssl 0.10.57-1 (forky)
▶Debianrust-openssl_project/rust-openssl< 0.10.57-1+1
▶Ubunturust-openssl_project/rust-openssl< 0.10.23-1ubuntu0.1~esm1+2
▶crates.ioopenssl/openssl0.10.0 — 0.10.55
▶NVDsfackler/openssl< 0.10.55

Patches

Patch: github.com ↗

🔴Vulnerability Details

4
OSV
rust-openssl vulnerabilities↗2025-11-26
▶
OSV
CVE-2023-53159: The openssl crate before 0↗2025-07-28
▶
GHSA
`openssl` `X509VerifyParamRef::set_host` buffer over-read↗2023-06-21
▶
OSV
`openssl` `X509VerifyParamRef::set_host` buffer over-read↗2023-06-21
▶

📋Vendor Advisories

4
Ubuntu
rust-openssl vulnerabilities↗2025-11-26
▶
Red Hat
openssl: OpenSSL: Out-of-bounds Read Vulnerability↗2025-07-28
▶
Microsoft
The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.↗2025-07-08
▶
Debian
CVE-2023-53159: rust-openssl - The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an em...↗2023
▶
CVE-2023-53159 — Buffer Over-read in Sfackler Openssl | cvebase