CVE-2023-53159: 
Rust vulnerability analysis and mitigation

The openssl crate before version 0.10.55 for Rust contains a buffer over-read vulnerability (CVE-2023-53159) that was discovered in June 2023. The vulnerability affects the X509VerifyParamRef::set_host function when it receives an empty string input. This security issue impacts the Rust implementation of OpenSSL bindings (RustSec Advisory).

The vulnerability occurs when X509VerifyParamRef::set_host function is called with an empty string parameter. In such cases, OpenSSL attempts to call strlen on the empty string, resulting in an out-of-bounds read that continues until it encounters a NUL byte in memory. The issue has been assigned a CVSS v3.1 base score of 4.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L (NVD).

When exploited, this vulnerability can lead to memory exposure through an out-of-bounds read operation. The impact is primarily related to information disclosure, as the vulnerability allows reading arbitrary memory contents until a NUL byte is encountered (RustSec Advisory).

The vulnerability has been patched in openssl crate version 0.10.55 and later. Users should upgrade to this version or newer to address the issue. For those unable to upgrade immediately, avoiding empty string inputs to the X509VerifyParamRef::set_host function can serve as a temporary workaround (RustSec Advisory).