CVE-2025-3416

Name of the Vulnerable Software and Affected Versions OpenSSL (affected versions not specified) rust-openssl crate versions prior to 0.10.71

Description A flaw exists in the handling of the properties argument within certain functions. This issue can lead to a use-after-free condition, which may result in undefined behavior or incorrect property parsing, causing the system to treat the input as an empty string. In the rust-openssl crate, this specifically affects the Md::fetch() and Cipher::fetch() functions. Exploitation of this memory corruption could potentially allow a remote attacker to execute arbitrary code or cause a denial of service.

Recommendations Update the rust-openssl crate to version 0.10.71 or later. As a temporary mitigation, restrict the use of the Md::fetch() and Cipher::fetch() functions until the update is applied.