GHSA-xcf7-rvmh-g6q4: 
Rust vulnerability analysis and mitigation

The vulnerability (GHSA-xcf7-rvmh-g6q4) affects the openssl Rust crate versions 0.10.0 through 0.10.54, specifically in the X509VerifyParamRef::set_host function. The issue was discovered and disclosed on June 19, 2023, and involves a buffer over-read vulnerability that occurs when the function is passed an empty string (GitHub Advisory, RustSec Advisory).

The vulnerability occurs when the X509VerifyParamRef::set_host function is called with an empty string parameter. In such cases, OpenSSL attempts to call strlen on the empty string, which results in reading arbitrary memory until a NUL byte is encountered. This issue was identified through Valgrind memory analysis, which showed an invalid read of size 1 occurring in the strlen function call (GitHub Issue).

When exploited, this vulnerability can lead to memory exposure as the program reads arbitrary memory beyond its intended boundaries. The issue manifests as a segmentation fault in affected applications, potentially exposing sensitive information stored in adjacent memory locations (GitHub Issue).

The vulnerability has been patched in version 0.10.55 of the openssl crate. Users are advised to upgrade to this version or later. For those unable to upgrade immediately, a workaround involves ensuring that empty strings are properly handled before being passed to the set_host function (GitHub Advisory).