Publish Advisories

GHSA-pqf5-4pqq-29f5
GHSA-xmgf-hq76-4vx2

Author: advisory-database[bot]

advisories/github-reviewed/2026/04/GHSA-pqf5-4pqq-29f5/GHSA-pqf5-4pqq-29f5.json

@@ -0,0 +1,70 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-pqf5-4pqq-29f5",
+  "modified": "2026-04-22T21:22:00Z",
+  "published": "2026-04-22T21:22:00Z",
+  "aliases": [
+    "CVE-2026-41676"
+  ],
+  "summary": "rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1",
+  "details": "`Deriver::derive` (and `PkeyCtxRef::derive`) sets `len = buf.len()` and passes it as the in/out length to `EVP_PKEY_derive`, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract  ignore the incoming `*keylen`, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "openssl"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.9.27"
+            },
+            {
+              "fixed": "0.10.78"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-pqf5-4pqq-29f5"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/rust-openssl/rust-openssl/pull/2606"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/rust-openssl/rust-openssl/commit/09b425e5f59a2466d806e71a83a9a449c914c596"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/rust-openssl/rust-openssl"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/rust-openssl/rust-openssl/releases/tag/openssl-v0.10.78"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-131",
+      "CWE-787"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-04-22T21:22:00Z",
+    "nvd_published_at": null
+  }
+}

advisories/github-reviewed/2026/04/GHSA-xmgf-hq76-4vx2/GHSA-xmgf-hq76-4vx2.json

@@ -0,0 +1,70 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-xmgf-hq76-4vx2",
+  "modified": "2026-04-22T21:20:04Z",
+  "published": "2026-04-22T21:20:04Z",
+  "aliases": [
+    "CVE-2026-41677"
+  ],
+  "summary": "rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length",
+  "details": "The `*_from_pem_callback` APIs did not validate the length returned by the user's callback. A password callback that returns a value larger than the buffer it was given can cause some versions of OpenSSL to over-read this buffer. OpenSSL 3.x is not affected by this.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "openssl"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.9.0"
+            },
+            {
+              "fixed": "0.10.78"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-xmgf-hq76-4vx2"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/rust-openssl/rust-openssl/pull/2605"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/rust-openssl/rust-openssl/commit/5af6895c907773699f37f583f409b862284062b1"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/rust-openssl/rust-openssl"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/rust-openssl/rust-openssl/releases/tag/openssl-v0.10.78"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-125",
+      "CWE-1284"
+    ],
+    "severity": "LOW",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-04-22T21:20:04Z",
+    "nvd_published_at": null
+  }
+}