{"id":4209419,"name":"openssl-src","ecosystem":"cargo","description":"Source of OpenSSL and logic to build it.\n","homepage":null,"licenses":"MIT/Apache-2.0","normalized_licenses":["MIT","Apache-2.0"],"repository_url":"https://github.com/alexcrichton/openssl-src-rs","keywords_array":[],"namespace":null,"versions_count":91,"first_release_published_at":"2017-08-29T04:49:53.890Z","latest_release_published_at":"2026-10-01T20:54:04.180Z","latest_release_number":"400.0.2+4.0.3","last_synced_at":"2026-10-14T06:27:15.248Z","created_at":"2022-04-12T21:07:59.619Z","updated_at":"2026-10-14T23:20:46.004Z","registry_url":"https://crates.io/crates/openssl-src/","install_command":"cargo install openssl-src","documentation_url":"https://docs.rs/openssl-src/","metadata":{"categories":[]},"repo_metadata":{"id":37579924,"uuid":"100758341","full_name":"alexcrichton/openssl-src-rs","owner":"alexcrichton","description":"Source code and logic to build OpenSSL from source","archived":false,"fork":false,"pushed_at":"2026-10-01T20:53:38.000Z","size":5099,"stargazers_count":81,"open_issues_count":43,"forks_count":132,"subscribers_count":9,"default_branch":"main","last_synced_at":"2026-10-03T01:33:42.885Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/alexcrichton.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE-APACHE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2017-08-19T00:00:25.000Z","updated_at":"2026-10-01T20:53:42.000Z","dependencies_parsed_at":"2024-06-22T10:43:21.881Z","dependency_job_id":"803f644e-cfc2-4cb2-ad3e-8c2f649528b9","html_url":"https://github.com/alexcrichton/openssl-src-rs","commit_stats":{"total_commits":247,"total_committers":78,"mean_commits":"3.1666666666666665","dds":0.5263157894736843,"last_synced_commit":"c879e60f2a9e71122b8d2608b7d15a94c07bee5b"},"previous_names":[],"tags_count":82,"template":false,"template_full_name":null,"purl":"pkg:github/alexcrichton/openssl-src-rs","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/alexcrichton","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/sbom","scorecard":{"id":181066,"data":{"date":"2025-08-11","repo":{"name":"github.com/alexcrichton/openssl-src-rs","commit":"626e28397a6b7858a0799638ad22aee504da8796"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":4.6,"checks":[{"name":"Maintained","score":1,"reason":"2 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Code-Review","score":7,"reason":"Found 23/30 approved changesets -- score normalized to 7","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/main.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE-APACHE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE-APACHE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:91: update your workflow using https://app.stepsecurity.io/secureworkflow/alexcrichton/openssl-src-rs/main.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:128: update your workflow using https://app.stepsecurity.io/secureworkflow/alexcrichton/openssl-src-rs/main.yml/main?enable=pin","Warn: containerImage not pinned by hash: ci/docker/aarch64-linux-android/Dockerfile:1: pin your Docker image by updating ubuntu:24.04 to ubuntu:24.04@sha256:7c06e91f61fa88c08cc74f7e1b7c69ae24910d745357e0dfe1d2c0322aaf20f9","Warn: containerImage not pinned by hash: ci/docker/aarch64-unknown-linux-gnu/Dockerfile:1: pin your Docker image by updating ubuntu:24.04 to ubuntu:24.04@sha256:7c06e91f61fa88c08cc74f7e1b7c69ae24910d745357e0dfe1d2c0322aaf20f9","Warn: containerImage not pinned by hash: ci/docker/arm-linux-androideabi/Dockerfile:1: pin your Docker image by updating ubuntu:24.04 to ubuntu:24.04@sha256:7c06e91f61fa88c08cc74f7e1b7c69ae24910d745357e0dfe1d2c0322aaf20f9","Warn: containerImage not pinned by hash: ci/docker/arm-unknown-linux-gnueabi/Dockerfile:1: pin your Docker image by updating ubuntu:24.04 to ubuntu:24.04@sha256:7c06e91f61fa88c08cc74f7e1b7c69ae24910d745357e0dfe1d2c0322aaf20f9","Warn: containerImage not pinned by hash: ci/docker/i686-linux-android/Dockerfile:1: pin your Docker image by updating ubuntu:24.04 to ubuntu:24.04@sha256:7c06e91f61fa88c08cc74f7e1b7c69ae24910d745357e0dfe1d2c0322aaf20f9","Warn: containerImage not pinned by hash: ci/docker/i686-unknown-linux-gnu/Dockerfile:1: pin your Docker image by updating ubuntu:24.04 to ubuntu:24.04@sha256:7c06e91f61fa88c08cc74f7e1b7c69ae24910d745357e0dfe1d2c0322aaf20f9","Warn: containerImage not pinned by hash: ci/docker/loongarch64-unknown-linux-gnu/Dockerfile:1: pin your Docker image by updating ubuntu:24.04 to ubuntu:24.04@sha256:7c06e91f61fa88c08cc74f7e1b7c69ae24910d745357e0dfe1d2c0322aaf20f9","Warn: containerImage not pinned by hash: ci/docker/riscv64gc-unknown-linux-gnu/Dockerfile:1: pin your Docker image by updating ubuntu:24.04 to ubuntu:24.04@sha256:7c06e91f61fa88c08cc74f7e1b7c69ae24910d745357e0dfe1d2c0322aaf20f9","Warn: containerImage not pinned by hash: ci/docker/wasm32-wasi/Dockerfile:1: pin your Docker image by updating ubuntu:22.04 to ubuntu:22.04@sha256:1aa979d85661c488ce030ac292876cf6ed04535d3a237e49f61542d8e5de5ae0","Warn: containerImage not pinned by hash: ci/docker/x86_64-linux-android/Dockerfile:1: pin your Docker image by updating ubuntu:24.04 to ubuntu:24.04@sha256:7c06e91f61fa88c08cc74f7e1b7c69ae24910d745357e0dfe1d2c0322aaf20f9","Warn: containerImage not pinned by hash: ci/docker/x86_64-pc-windows-gnu/Dockerfile:1: pin your Docker image by updating ubuntu:24.04 to ubuntu:24.04@sha256:7c06e91f61fa88c08cc74f7e1b7c69ae24910d745357e0dfe1d2c0322aaf20f9","Warn: containerImage not pinned by hash: ci/docker/x86_64-unknown-linux-gnu/Dockerfile:1: pin your Docker image by updating ubuntu:24.04 to ubuntu:24.04@sha256:7c06e91f61fa88c08cc74f7e1b7c69ae24910d745357e0dfe1d2c0322aaf20f9","Warn: containerImage not pinned by hash: ci/docker/x86_64-unknown-linux-musl/Dockerfile:1: pin your Docker image by updating ubuntu:24.04 to ubuntu:24.04@sha256:7c06e91f61fa88c08cc74f7e1b7c69ae24910d745357e0dfe1d2c0322aaf20f9","Warn: downloadThenRun not pinned by hash: ci/docker/wasm32-wasi/Dockerfile:12","Info:   0 out of   2 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of  13 containerImage dependencies pinned","Info:   0 out of   1 downloadThenRun dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-16T18:53:11.104Z","repository_id":37579924,"created_at":"2025-08-16T18:53:11.104Z","updated_at":"2025-08-16T18:53:11.104Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":343072799,"owners_count":37968610,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-10-03T02:00:07.567Z","response_time":59,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"alexcrichton","name":"Alex Crichton","uuid":"64996","kind":"user","description":"","email":"alex@alexcrichton.com","website":null,"location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/64996?v=4","repositories_count":471,"last_synced_at":"2026-10-09T14:43:06.504Z","metadata":{"has_sponsors_listing":false,"funding":null},"html_url":"https://github.com/alexcrichton","funding_links":[],"total_stars":4565,"followers":5477,"following":0,"created_at":"2022-11-02T16:22:32.650Z","updated_at":"2026-10-09T14:43:06.520Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/alexcrichton","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/alexcrichton/repositories"},"tags":[{"name":"300.6.0+3.6.2","sha":"27515dc39a4339178d1c12ddfc1a1edf091f6d00","kind":"commit","published_at":"2026-04-07T18:07:14.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.6.0+3.6.2","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.6.0+3.6.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.6.0%2B3.6.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.6.0+3.6.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.6.0+3.6.2/manifests"},{"name":"300.5.5+3.5.5","sha":"82360627527a85feefe41e2c1f2b2911c16c3109","kind":"commit","published_at":"2026-01-27T22:26:22.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.5.5+3.5.5","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.5.5+3.5.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.5.5%2B3.5.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.5.5+3.5.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.5.5+3.5.5/manifests"},{"name":"300.5.4+3.5.4","sha":"c13a58dc53bb9e2f18155d4f6f97d524b5a68127","kind":"commit","published_at":"2025-10-20T21:45:15.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.5.4+3.5.4","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.5.4+3.5.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.5.4%2B3.5.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.5.4+3.5.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.5.4+3.5.4/manifests"},{"name":"300.5.3+3.5.4","sha":"f08cb164396d1a380340049719531fe57c904326","kind":"commit","published_at":"2025-09-30T14:45:17.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.5.3+3.5.4","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.5.3+3.5.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.5.3%2B3.5.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.5.3+3.5.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.5.3+3.5.4/manifests"},{"name":"300.5.2+3.5.2","sha":"626e28397a6b7858a0799638ad22aee504da8796","kind":"commit","published_at":"2025-08-08T15:31:27.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.5.2+3.5.2","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.5.2+3.5.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.5.2%2B3.5.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.5.2+3.5.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.5.2+3.5.2/manifests"},{"name":"300.5.1+3.5.1","sha":"4efc029b54f899fa392d8cec6e9d3bb25fedf728","kind":"commit","published_at":"2025-07-01T22:40:31.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.5.1+3.5.1","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.5.1+3.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.5.1%2B3.5.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.5.1+3.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.5.1+3.5.1/manifests"},{"name":"300.5.0+3.5.0","sha":"7d112379fbbc6a4c343cd2d746b8e257bc75eff5","kind":"commit","published_at":"2025-04-08T22:00:54.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.5.0+3.5.0","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.5.0+3.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.5.0%2B3.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.5.0+3.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.5.0+3.5.0/manifests"},{"name":"300.4.2+3.4.1","sha":"4749908782f3bbc34886c39093dcb77b3a6dbff1","kind":"commit","published_at":"2025-02-11T16:03:48.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.4.2+3.4.1","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.4.2+3.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.4.2%2B3.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.4.2+3.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.4.2+3.4.1/manifests"},{"name":"300.4.1+3.4.0","sha":"c879e60f2a9e71122b8d2608b7d15a94c07bee5b","kind":"commit","published_at":"2024-11-16T04:29:46.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.4.1+3.4.0","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.4.1+3.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.4.1%2B3.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.4.1+3.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.4.1+3.4.0/manifests"},{"name":"300.4.0+3.4.0","sha":"35bc813a4fdfb7789fcc014d151b081eb67239ad","kind":"commit","published_at":"2024-10-22T17:59:30.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.4.0+3.4.0","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.4.0+3.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.4.0%2B3.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.4.0+3.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.4.0+3.4.0/manifests"},{"name":"300.3.2+3.3.2","sha":"690dd7db243786b531ad6892d6687ed4e68e62b9","kind":"commit","published_at":"2024-09-03T14:40:31.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.3.2+3.3.2","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.3.2+3.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.3.2%2B3.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.3.2+3.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.3.2+3.3.2/manifests"},{"name":"300.3.1+3.3.1","sha":"c591de676017446c9f1d719e77eb162159ce8886","kind":"commit","published_at":"2024-06-04T15:26:03.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.3.1+3.3.1","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.3.1+3.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.3.1%2B3.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.3.1+3.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.3.1+3.3.1/manifests"},{"name":"111.28.2+1.1.1w","sha":"8c19f63843c8cb84c8fd27fd6db8c1ff687d2da2","kind":"commit","published_at":"2024-05-28T15:01:30.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.28.2+1.1.1w","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.28.2+1.1.1w","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.28.2%2B1.1.1w","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.28.2+1.1.1w","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.28.2+1.1.1w/manifests"},{"name":"300.3.0+3.3.0","sha":"f8218a9262812aacd21db4f2adca19d32265583d","kind":"commit","published_at":"2024-05-21T18:05:07.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.3.0+3.3.0","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.3.0+3.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.3.0%2B3.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.3.0+3.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.3.0+3.3.0/manifests"},{"name":"300.2.3+3.2.1","sha":"30860617df584f1ec6f3a3f55d3cf638aab5ea0b","kind":"commit","published_at":"2024-02-12T16:45:58.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.2.3+3.2.1","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.2.3+3.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.2.3%2B3.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.2.3+3.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.2.3+3.2.1/manifests"},{"name":"300.2.2+3.2.1","sha":"add20f73b6b42be7451af2e1044d4e0e778992b2","kind":"commit","published_at":"2024-01-30T15:28:44.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.2.2+3.2.1","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.2.2+3.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.2.2%2B3.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.2.2+3.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.2.2+3.2.1/manifests"},{"name":"300.2.1+3.2.0","sha":"47d047ae37ed3489dad7164e1732cbeac689d185","kind":"commit","published_at":"2023-12-11T15:43:21.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.2.1+3.2.0","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.2.1+3.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.2.1%2B3.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.2.1+3.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.2.1+3.2.0/manifests"},{"name":"111.28.1+1.1.1w","sha":"cb7b3c8862f93f38a28c8200b88eb4c1be107323","kind":"commit","published_at":"2023-12-11T15:42:58.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.28.1+1.1.1w","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.28.1+1.1.1w","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.28.1%2B1.1.1w","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.28.1+1.1.1w","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.28.1+1.1.1w/manifests"},{"name":"300.2.0+3.2.0","sha":"90dae386356ea4d97d93e2be91934223a00ce87f","kind":"commit","published_at":"2023-12-08T16:15:27.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.2.0+3.2.0","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.2.0+3.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.2.0%2B3.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.2.0+3.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.2.0+3.2.0/manifests"},{"name":"300.1.5+3.1.3","sha":"222ed0b527b65575998d6e01cb7304a9cde6cb94","kind":"commit","published_at":"2023-09-19T14:32:43.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.1.5+3.1.3","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.1.5+3.1.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.1.5%2B3.1.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.1.5+3.1.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.1.5+3.1.3/manifests"},{"name":"300.1.4+3.1.2","sha":"6ebeda9e7ec3fa3d4bf3aecebf9798f686ba11d3","kind":"commit","published_at":"2023-09-18T21:15:58.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.1.4+3.1.2","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.1.4+3.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.1.4%2B3.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.1.4+3.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.1.4+3.1.2/manifests"},{"name":"111.28.0+1.1.1w","sha":"8f97c0e3c3a718d6c7076721e180e72364b7a36a","kind":"commit","published_at":"2023-09-11T16:26:44.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.28.0+1.1.1w","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.28.0+1.1.1w","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.28.0%2B1.1.1w","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.28.0+1.1.1w","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.28.0+1.1.1w/manifests"},{"name":"111.27.0+1.1.1v","sha":"0b4b93667e560356a4dd170e2e0d223f30994cfa","kind":"commit","published_at":"2023-08-02T10:04:41.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.27.0+1.1.1v","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.27.0+1.1.1v","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.27.0%2B1.1.1v","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.27.0+1.1.1v","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.27.0+1.1.1v/manifests"},{"name":"300.1.3+3.1.2","sha":"557154fb62921ca84a2a52ea82501e2552d94d63","kind":"commit","published_at":"2023-08-02T09:41:09.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.1.3+3.1.2","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.1.3+3.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.1.3%2B3.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.1.3+3.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.1.3+3.1.2/manifests"},{"name":"300.1.2+3.1.1","sha":"b6c9b30a7eff67a8324440e45f6e0a5e1170df0f","kind":"commit","published_at":"2023-05-31T14:09:18.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.1.2+3.1.1","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.1.2+3.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.1.2%2B3.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.1.2+3.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.1.2+3.1.1/manifests"},{"name":"111.26.0+1.1.1u","sha":"a9b8f74f23b3f39c8fb0a7dc233eba6e3919fc51","kind":"commit","published_at":"2023-05-31T14:09:09.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.26.0+1.1.1u","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.26.0+1.1.1u","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.26.0%2B1.1.1u","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.26.0+1.1.1u","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.26.0+1.1.1u/manifests"},{"name":"300.1.0+3.1.0","sha":"6d82a28eda47256f87020e81ae5a79728fcb8e3f","kind":"commit","published_at":"2023-03-29T17:36:45.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.1.0+3.1.0","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.1.0+3.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.1.0%2B3.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.1.0+3.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.1.0+3.1.0/manifests"},{"name":"111.25.1+1.1.1t","sha":"cb140c07e479fb5e763bb2dc1c879ae368320428","kind":"commit","published_at":"2023-02-27T23:23:37.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.25.1+1.1.1t","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.25.1+1.1.1t","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.25.1%2B1.1.1t","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.25.1+1.1.1t","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.25.1+1.1.1t/manifests"},{"name":"111.25.0+1.1.1t","sha":"29cb0b37c6e762cfeeba0cfc898bfd5b8db55f2e","kind":"commit","published_at":"2023-02-07T17:16:10.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.25.0+1.1.1t","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.25.0+1.1.1t","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.25.0%2B1.1.1t","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.25.0+1.1.1t","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.25.0+1.1.1t/manifests"},{"name":"300.0.12+3.0.8","sha":"50efcdeac601febc3ab5a90f3eb729e472c124e1","kind":"commit","published_at":"2023-02-07T17:16:08.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.0.12+3.0.8","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.0.12+3.0.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.0.12%2B3.0.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.12+3.0.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.12+3.0.8/manifests"},{"name":"300.0.11+3.0.7","sha":"e41d5a7820da8e2e73a24af2c2bc1c08fe50ffeb","kind":"commit","published_at":"2022-11-01T17:07:17.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.0.11+3.0.7","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.0.11+3.0.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.0.11%2B3.0.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.11+3.0.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.11+3.0.7/manifests"},{"name":"111.24.0+1.1.1s","sha":"b5a61821d62f4161f5480e542601668ece0e26c2","kind":"commit","published_at":"2022-11-01T16:32:09.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.24.0+1.1.1s","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.24.0+1.1.1s","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.24.0%2B1.1.1s","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.24.0+1.1.1s","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.24.0+1.1.1s/manifests"},{"name":"111.23.0+1.1.1r","sha":"36873e9d08d5bbc7b31b3adf10b522d7b4d8c412","kind":"commit","published_at":"2022-10-11T20:44:07.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.23.0+1.1.1r","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.23.0+1.1.1r","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.23.0%2B1.1.1r","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.23.0+1.1.1r","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.23.0+1.1.1r/manifests"},{"name":"300.0.10+3.0.6","sha":"048d5f5584643b02ed633ca0b2ac061188ad6f87","kind":"commit","published_at":"2022-10-11T20:43:15.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.0.10+3.0.6","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.0.10+3.0.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.0.10%2B3.0.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.10+3.0.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.10+3.0.6/manifests"},{"name":"300.0.9+3.0.5","sha":"87c618aa86839b1fb82b25adf5967edb8b1345c0","kind":"commit","published_at":"2022-07-05T14:08:46.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.0.9+3.0.5","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.0.9+3.0.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.0.9%2B3.0.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.9+3.0.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.9+3.0.5/manifests"},{"name":"111.22.0+1.1.1q","sha":"021754a8b9f60df5a1be3436a1bb4f7f5a3360d0","kind":"commit","published_at":"2022-07-05T14:08:35.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.22.0+1.1.1q","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.22.0+1.1.1q","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.22.0%2B1.1.1q","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.22.0+1.1.1q","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.22.0+1.1.1q/manifests"},{"name":"300.0.8+3.0.4","sha":"0e9ec2f8b30ee89a8d1a486e100e03718a960665","kind":"commit","published_at":"2022-06-21T19:51:40.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.0.8+3.0.4","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.0.8+3.0.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.0.8%2B3.0.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.8+3.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.8+3.0.4/manifests"},{"name":"111.21.0+1.1.1p","sha":"e4efee1151e17ff702ab48d705474470aea8b38f","kind":"commit","published_at":"2022-06-21T19:33:11.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.21.0+1.1.1p","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.21.0+1.1.1p","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.21.0%2B1.1.1p","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.21.0+1.1.1p","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.21.0+1.1.1p/manifests"},{"name":"300.0.7+3.0.3","sha":"60186eaa3dd2f9847deeba48a1c7d73572a389ff","kind":"commit","published_at":"2022-05-19T16:26:10.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.0.7+3.0.3","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.0.7+3.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.0.7%2B3.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.7+3.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.7+3.0.3/manifests"},{"name":"111.20.0+1.1.1o","sha":"f92d509f6a4795e089e756fe8d6d23b3e37aac96","kind":"commit","published_at":"2022-05-19T15:24:40.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.20.0+1.1.1o","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.20.0+1.1.1o","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.20.0%2B1.1.1o","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.20.0+1.1.1o","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.20.0+1.1.1o/manifests"},{"name":"111.19.0+1.1.1o","sha":"24f3ff438db8f8556d050d57cad36ee328269062","kind":"commit","published_at":"2022-05-19T00:17:59.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.19.0+1.1.1o","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.19.0+1.1.1o","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.19.0%2B1.1.1o","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.19.0+1.1.1o","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.19.0+1.1.1o/manifests"},{"name":"300.0.6+3.0.3","sha":"9f28b4c1d100bde2b79752d4518e102814f9ec39","kind":"commit","published_at":"2022-05-05T17:42:28.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.0.6+3.0.3","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.0.6+3.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.0.6%2B3.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.6+3.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.6+3.0.3/manifests"},{"name":"300.0.5+3.0.2","sha":"c98db0989cf2d6cf76ed4a25f224140c9b472f1a","kind":"commit","published_at":"2022-03-16T14:14:35.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.0.5+3.0.2","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.0.5+3.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.0.5%2B3.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.5+3.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.5+3.0.2/manifests"},{"name":"111.18.0+1.1.1n","sha":"6e3783068a32ae5efe166c62e15cf863824897b9","kind":"commit","published_at":"2022-03-16T14:14:22.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.18.0+1.1.1n","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.18.0+1.1.1n","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.18.0%2B1.1.1n","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.18.0+1.1.1n","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.18.0+1.1.1n/manifests"},{"name":"111.17.0+1.1.1m","sha":"f082ecca87e2c38cff336de0fd4e187910105cb8","kind":"tag","published_at":"2021-12-15T00:05:16.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.17.0+1.1.1m","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.17.0+1.1.1m","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.17.0%2B1.1.1m","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.17.0+1.1.1m","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.17.0+1.1.1m/manifests"},{"name":"300.0.4+3.0.1","sha":"f292e64d8156c45f9a99ec226860c0fdb8380ec5","kind":"commit","published_at":"2021-12-14T19:00:17.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.0.4+3.0.1","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.0.4+3.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.0.4%2B3.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.4+3.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.4+3.0.1/manifests"},{"name":"300.0.3+3.0.0","sha":"dbbb10dff5d5fe2745ce0d7fb42f2622b68b713d","kind":"tag","published_at":"2021-12-08T12:50:21.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.0.3+3.0.0","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.0.3+3.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.0.3%2B3.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.3+3.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.3+3.0.0/manifests"},{"name":"300.0.2+3.0.0","sha":"132ee04a49581f920de1ac7601b251063e081d1e","kind":"commit","published_at":"2021-10-12T15:01:46.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.0.2+3.0.0","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.0.2+3.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.0.2%2B3.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.2+3.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.2+3.0.0/manifests"},{"name":"300.0.1+3.0.0","sha":"7e9d7e9dabbdeee4a51037a7298bc32171a9dd03","kind":"commit","published_at":"2021-09-13T14:57:34.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.0.1+3.0.0","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.0.1+3.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.0.1%2B3.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.1+3.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.1+3.0.0/manifests"},{"name":"300.0.0+3.0.0","sha":"e8c3534ebfa23cab2ff2a3b8a2e6f778a21d0295","kind":"commit","published_at":"2021-09-09T19:14:26.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/300.0.0+3.0.0","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/300.0.0+3.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@300.0.0%2B3.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.0+3.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/300.0.0+3.0.0/manifests"},{"name":"111.16.0+1.1.1l","sha":"164696d5e1ae94ab89e4c6c2e8dfcc6ccfc40e1a","kind":"commit","published_at":"2021-08-24T15:21:23.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.16.0+1.1.1l","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.16.0+1.1.1l","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.16.0%2B1.1.1l","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.16.0+1.1.1l","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.16.0+1.1.1l/manifests"},{"name":"111.15.0+1.1.1k","sha":"11826838f1627c6575e888b47464627fb75aaf53","kind":"commit","published_at":"2021-03-25T14:23:39.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.15.0+1.1.1k","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.15.0+1.1.1k","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.15.0%2B1.1.1k","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.15.0+1.1.1k","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.15.0+1.1.1k/manifests"},{"name":"111.14.0+1.1.1j","sha":"e634b86cbfb6ef279b950a81ae65052d32d1468c","kind":"commit","published_at":"2021-02-18T15:08:59.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.14.0+1.1.1j","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.14.0+1.1.1j","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.14.0%2B1.1.1j","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.14.0+1.1.1j","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.14.0+1.1.1j/manifests"},{"name":"111.13.0+1.1.1i","sha":"c73bd127e00f8970d3c15a2d9bfcb6cf9bdfacdc","kind":"commit","published_at":"2020-12-09T16:43:02.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.13.0+1.1.1i","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.13.0+1.1.1i","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.13.0%2B1.1.1i","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.13.0+1.1.1i","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.13.0+1.1.1i/manifests"},{"name":"111.12.0+1.1.1h","sha":"8338b33a01b4e4ad777d3f06b21415466b6ebf95","kind":"commit","published_at":"2020-10-11T17:11:04.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.12.0+1.1.1h","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.12.0+1.1.1h","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.12.0%2B1.1.1h","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.12.0+1.1.1h","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.12.0+1.1.1h/manifests"},{"name":"111.11.0+1.1.1h","sha":"9e7d91a01c48d6d07c02f71483188b1819455ba1","kind":"commit","published_at":"2020-09-24T20:44:29.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.11.0+1.1.1h","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.11.0+1.1.1h","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.11.0%2B1.1.1h","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.11.0+1.1.1h","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.11.0+1.1.1h/manifests"},{"name":"111.10.2+1.1.1g","sha":"266e96f9968d75fb13e21a206114631c85b831bb","kind":"commit","published_at":"2020-07-20T14:32:35.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.10.2+1.1.1g","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.10.2+1.1.1g","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.10.2%2B1.1.1g","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.10.2+1.1.1g","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.10.2+1.1.1g/manifests"},{"name":"111.10.1+1.1.1g","sha":"9713ad8cc4d5ea0c379d0ad41f9e418863aaf544","kind":"commit","published_at":"2020-07-08T17:28:30.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.10.1+1.1.1g","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.10.1+1.1.1g","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.10.1%2B1.1.1g","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.10.1+1.1.1g","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.10.1+1.1.1g/manifests"},{"name":"111.10.0+1.1.1g","sha":"6012eaa1a7e163e56049dae0841e11f1e0e8fba2","kind":"commit","published_at":"2020-06-10T14:46:21.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.10.0+1.1.1g","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.10.0+1.1.1g","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.10.0%2B1.1.1g","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.10.0+1.1.1g","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.10.0+1.1.1g/manifests"},{"name":"111.9.0+1.1.1g","sha":"babdbf06116b22f8fa276da4e25b134d28b54494","kind":"commit","published_at":"2020-04-21T14:57:26.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.9.0+1.1.1g","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.9.0+1.1.1g","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.9.0%2B1.1.1g","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.9.0+1.1.1g","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.9.0+1.1.1g/manifests"},{"name":"111.8.1+1.1.1f","sha":"889f9bafbfa808c030b758ed2d58d043ebb51974","kind":"commit","published_at":"2020-04-01T12:09:39.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.8.1+1.1.1f","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.8.1+1.1.1f","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.8.1%2B1.1.1f","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.8.1+1.1.1f","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.8.1+1.1.1f/manifests"},{"name":"111.8.0+1.1.1f","sha":"5de7a3d8412c540a8d64d80faf220b5dbc7cea45","kind":"commit","published_at":"2020-03-31T21:26:02.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.8.0+1.1.1f","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.8.0+1.1.1f","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.8.0%2B1.1.1f","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.8.0+1.1.1f","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.8.0+1.1.1f/manifests"},{"name":"111.7.0+1.1.1e","sha":"128c0c5459c5edbd70a141c75b9c166abac31ad5","kind":"commit","published_at":"2020-03-20T01:58:33.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.7.0+1.1.1e","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.7.0+1.1.1e","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.7.0%2B1.1.1e","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.7.0+1.1.1e","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.7.0+1.1.1e/manifests"},{"name":"111.6.1+1.1.1d","sha":"1450970d8e9a02761ef41815a99723a4716b2cdd","kind":"commit","published_at":"2019-12-02T21:07:21.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.6.1+1.1.1d","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.6.1+1.1.1d","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.6.1%2B1.1.1d","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.6.1+1.1.1d","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.6.1+1.1.1d/manifests"},{"name":"111.6.0+1.1.1d","sha":"558274a5f509ea2497171edc983115d10657a390","kind":"commit","published_at":"2019-09-11T13:54:21.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.6.0+1.1.1d","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.6.0+1.1.1d","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.6.0%2B1.1.1d","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.6.0+1.1.1d","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.6.0+1.1.1d/manifests"},{"name":"111.5.0+1.1.1c","sha":"3c49ff264ecd000aa15cbf42092ba33116fb2efb","kind":"commit","published_at":"2019-08-12T20:16:12.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.5.0+1.1.1c","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.5.0+1.1.1c","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.5.0%2B1.1.1c","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.5.0+1.1.1c","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.5.0+1.1.1c/manifests"},{"name":"111.4.0+1.1.1c","sha":"d48a07c76a1a204feb3b35350b27b2971b893056","kind":"commit","published_at":"2019-07-23T02:58:37.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.4.0+1.1.1c","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.4.0+1.1.1c","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.4.0%2B1.1.1c","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.4.0+1.1.1c","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.4.0+1.1.1c/manifests"},{"name":"111.3.0+1.1.1c","sha":"ce7d7475bb7a24063a26db2d232d39fe939a0e17","kind":"commit","published_at":"2019-05-31T17:34:11.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.3.0+1.1.1c","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.3.0+1.1.1c","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.3.0%2B1.1.1c","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.3.0+1.1.1c","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.3.0+1.1.1c/manifests"},{"name":"111.2.1+1.1.1b","sha":"09eec5bf51307091e7cedd7436e6ae3400a37a60","kind":"commit","published_at":"2019-03-06T21:54:54.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.2.1+1.1.1b","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.2.1+1.1.1b","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.2.1%2B1.1.1b","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.2.1+1.1.1b","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.2.1+1.1.1b/manifests"},{"name":"111.1.1+1.1.1a","sha":"6dca41711ccc8f3e44c722bc2923cf3ed0ab28e9","kind":"commit","published_at":"2019-02-25T15:33:54.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.1.1+1.1.1a","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.1.1+1.1.1a","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.1.1%2B1.1.1a","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.1.1+1.1.1a","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.1.1+1.1.1a/manifests"},{"name":"111.1.0+1.1.1a","sha":"4009c19c62f43f1b1e1df4a6d83c893213567345","kind":"commit","published_at":"2018-11-30T02:49:02.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.1.0+1.1.1a","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.1.0+1.1.1a","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.1.0%2B1.1.1a","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.1.0+1.1.1a","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.1.0+1.1.1a/manifests"},{"name":"111.0.1+1.1.1","sha":"d120b5ab2c9d8739974e81c8023890298afc4a9a","kind":"commit","published_at":"2018-10-16T13:58:31.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.0.1+1.1.1","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.0.1+1.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.0.1%2B1.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.0.1+1.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.0.1+1.1.1/manifests"},{"name":"111.0.0+1.1.1","sha":"0e63995dd4a6d0e8770d490d2effc130c49dd235","kind":"commit","published_at":"2018-10-16T04:48:27.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/111.0.0+1.1.1","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/111.0.0+1.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@111.0.0%2B1.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.0.0+1.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/111.0.0+1.1.1/manifests"},{"name":"110.0.7+1.1.0i","sha":"a26ad73902781df5f502e14e2c1f166931761e7f","kind":"commit","published_at":"2018-08-20T20:45:24.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/110.0.7+1.1.0i","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/110.0.7+1.1.0i","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@110.0.7%2B1.1.0i","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/110.0.7+1.1.0i","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/110.0.7+1.1.0i/manifests"},{"name":"110.0.6+1.1.0h","sha":"9778ace4e454af420a1969216bb8a099c2d3c443","kind":"commit","published_at":"2018-08-14T20:35:03.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/110.0.6+1.1.0h","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/110.0.6+1.1.0h","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@110.0.6%2B1.1.0h","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/110.0.6+1.1.0h","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/110.0.6+1.1.0h/manifests"},{"name":"110.0.5+1.1.0h","sha":"08975ec23878635cc0c0be75d8d4d7df81cf561b","kind":"commit","published_at":"2018-08-04T15:24:30.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/110.0.5+1.1.0h","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/110.0.5+1.1.0h","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@110.0.5%2B1.1.0h","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/110.0.5+1.1.0h","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/110.0.5+1.1.0h/manifests"},{"name":"110.0.4+1.1.0h","sha":"d02dc8712020ff5f691d010637328ff343fda886","kind":"commit","published_at":"2018-07-30T22:13:46.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/110.0.4+1.1.0h","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/110.0.4+1.1.0h","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@110.0.4%2B1.1.0h","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/110.0.4+1.1.0h","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/110.0.4+1.1.0h/manifests"},{"name":"110.0.3+1.1.0h","sha":"bbf1b5d140c3716ad35befac233a044f0c3d454d","kind":"commit","published_at":"2018-07-28T21:56:31.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/110.0.3+1.1.0h","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/110.0.3+1.1.0h","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@110.0.3%2B1.1.0h","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/110.0.3+1.1.0h","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/110.0.3+1.1.0h/manifests"},{"name":"110.0.2+1.1.0h","sha":"61c6d6886311e7bf817481e915f97490a7a49c09","kind":"commit","published_at":"2018-04-20T18:41:17.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/110.0.2+1.1.0h","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/110.0.2+1.1.0h","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@110.0.2%2B1.1.0h","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/110.0.2+1.1.0h","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/110.0.2+1.1.0h/manifests"},{"name":"110.0.1+1.1.0f","sha":"725f2a444ee986d64e0dc4c269ec2cea14a3e05a","kind":"tag","published_at":"2017-09-15T21:25:58.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/110.0.1+1.1.0f","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/110.0.1+1.1.0f","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@110.0.1%2B1.1.0f","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/110.0.1+1.1.0f","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/110.0.1+1.1.0f/manifests"},{"name":"110.0.0+1.1.0f","sha":"04d95ed3060a0c8bcda213a3871407a6fe0f9046","kind":"tag","published_at":"2017-09-15T21:16:37.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/110.0.0+1.1.0f","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/110.0.0+1.1.0f","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@110.0.0%2B1.1.0f","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/110.0.0+1.1.0f","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/110.0.0+1.1.0f/manifests"},{"name":"110.0.0","sha":"b6e4564e0cc91ace69a0b63fd023777a50c91389","kind":"tag","published_at":"2017-08-29T04:49:59.000Z","download_url":"https://codeload.github.com/alexcrichton/openssl-src-rs/tar.gz/110.0.0","html_url":"https://github.com/alexcrichton/openssl-src-rs/releases/tag/110.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/alexcrichton/openssl-src-rs@110.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/110.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/tags/110.0.0/manifests"}]},"repo_metadata_updated_at":"2026-10-14T06:28:23.191Z","dependent_packages_count":13,"downloads":110661801,"downloads_period":"total","dependent_repos_count":3600,"rankings":{"downloads":0.42596105700402687,"dependent_repos_count":0.6149636452111117,"dependent_packages_count":3.6559306614385356,"stargazers_count":15.30497824354535,"forks_count":6.423267064888538,"docker_downloads_count":0.27927248108211034,"average":4.450728858861612},"purl":"pkg:cargo/openssl-src","advisories":[{"uuid":"GSA_kwCzR0hTQS1wNTJnLWNtNWotbWp2NM4AAxfu","url":"https://github.com/advisories/GHSA-p52g-cm5j-mjv4","title":"openssl-src subject to Timing Oracle in RSA Decryption","description":"A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE.\n\nFor example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2023-02-08T22:31:42.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.9,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2022-4304","https://rustsec.org/advisories/RUSTSEC-2023-0007.html","https://www.openssl.org/news/secadv/20230207.txt","https://security.gentoo.org/glsa/202402-08","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003","https://github.com/advisories/GHSA-p52g-cm5j-mjv4"],"source_kind":"github","identifiers":["GHSA-p52g-cm5j-mjv4","CVE-2022-4304"],"repository_url":null,"blast_radius":0.0,"created_at":"2023-02-08T23:03:18.270Z","updated_at":"2026-10-12T14:13:34.860Z","epss_percentage":0.16195,"epss_percentile":0.96531,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wNTJnLWNtNWotbWp2NM4AAxfu","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wNTJnLWNtNWotbWp2NM4AAxfu","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"300.0.12","vulnerable_version_range":"\u003e= 300.0.0, \u003c 300.0.12"},{"first_patched_version":"111.25.0","vulnerable_version_range":"\u003c 111.25.0"}],"purl":"pkg:cargo/openssl-src"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wNTJnLWNtNWotbWp2NM4AAxfu/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1yN2p3LXdwNjgtM3hjaM4AAxft","url":"https://github.com/advisories/GHSA-r7jw-wp68-3xch","title":"openssl-src vulnerable to Use-after-free following `BIO_new_NDEF`","description":"The public API function `BIO_new_NDEF` is a helper function used for streaming ASN.1 data via a `BIO`. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.\n\nThe function receives a `BIO` from the caller, prepends a new `BIO_f_asn1` filter `BIO` onto the front of it to form a `BIO` chain, and then returns the new head of the `BIO` chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter `BIO` is freed and the function returns a `NULL` result indicating a failure. However, in this case, the `BIO` chain is not properly cleaned up and the `BIO` passed by the caller still retains internal pointers to the previously freed filter `BIO`. If the caller then goes on to call `BIO_pop()` on the `BIO` then a use-after-free will occur. This will most likely result in a crash.\n\nThis scenario occurs directly in the internal function `B64_write_ASN1()` which may cause `BIO_new_NDEF()` to be called and will subsequently call `BIO_pop()` on the `BIO`. This internal function is in turn called by the public API functions `PEM_write_bio_ASN1_stream`, `PEM_write_bio_CMS_stream`, `PEM_write_bio_PKCS7_stream`, `SMIME_write_ASN1`, `SMIME_write_CMS` and `SMIME_write_PKCS7`.\n\nOther public API functions that may be impacted by this include `i2d_ASN1_bio_stream`, `BIO_new_CMS`, `BIO_new_PKCS7`, `i2d_CMS_bio_stream` and `i2d_PKCS7_bio_stream`.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2023-02-08T22:28:34.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2023-0215","https://rustsec.org/advisories/RUSTSEC-2023-0009.html","https://www.openssl.org/news/secadv/20230207.txt","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8818064ce3c3c0f1b740a5aaba2a987e75bfbafd","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9816136fe31d92ace4037d5da5257f763aeeb4eb","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c3829dd8825c654652201e16f8a0a0c46ee3f344","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230427-0007","https://security.netapp.com/advisory/ntap-20230427-0009","https://security.netapp.com/advisory/ntap-20240621-0006","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003","https://github.com/advisories/GHSA-r7jw-wp68-3xch"],"source_kind":"github","identifiers":["GHSA-r7jw-wp68-3xch","CVE-2023-0215"],"repository_url":null,"blast_radius":0.0,"created_at":"2023-02-08T23:03:18.280Z","updated_at":"2026-10-08T08:00:42.250Z","epss_percentage":0.04494,"epss_percentile":0.90505,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yN2p3LXdwNjgtM3hjaM4AAxft","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1yN2p3LXdwNjgtM3hjaM4AAxft","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"300.0.12","vulnerable_version_range":"\u003e= 300.0.0, \u003c 300.0.12"},{"first_patched_version":"111.25.0","vulnerable_version_range":"\u003c 111.25.0"}],"purl":"pkg:cargo/openssl-src"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yN2p3LXdwNjgtM3hjaM4AAxft/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS13Njd3LW13NGotOHFyds4AAxfs","url":"https://github.com/advisories/GHSA-w67w-mw4j-8qrv","title":"openssl-src contains Read Buffer Overflow in X.509 Name Constraint","description":"A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs\nafter certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to\ncontinue certificate verification despite failure to construct a path to a trusted issuer.\n\nThe read buffer overrun might result in a crash which could lead to a denial of service attack. In theory it could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext) although we are not aware of any working exploit leading to memory contents disclosure as of the time of release of this advisory.\n\nIn a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2023-02-08T22:27:42.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2022-4203","https://rustsec.org/advisories/RUSTSEC-2023-0008.html","https://www.openssl.org/news/secadv/20230207.txt","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c927a3492698c254637da836762f9b1f86cffabc","https://security.gentoo.org/glsa/202402-08","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003","https://github.com/advisories/GHSA-w67w-mw4j-8qrv"],"source_kind":"github","identifiers":["GHSA-w67w-mw4j-8qrv","CVE-2022-4203"],"repository_url":null,"blast_radius":0.0,"created_at":"2023-02-08T23:03:18.289Z","updated_at":"2026-10-14T23:15:44.159Z","epss_percentage":0.01386,"epss_percentile":0.71531,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13Njd3LW13NGotOHFyds4AAxfs","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS13Njd3LW13NGotOHFyds4AAxfs","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"300.0.12","vulnerable_version_range":"\u003e= 300.0.0, \u003c 300.0.12"}],"purl":"pkg:cargo/openssl-src"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13Njd3LW13NGotOHFyds4AAxfs/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0yOXh4LWhjdjItYzRjcM4AAxfr","url":"https://github.com/advisories/GHSA-29xx-hcv2-c4cp","title":"openssl-src subject to Invalid pointer dereference in `d2i_PKCS7` functions","description":"An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the `d2i_PKCS7()`, `d2i_PKCS7_bio()` or `d2i_PKCS7_fp()` functions.\n\nThe result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2023-02-08T22:23:39.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2023-0216","https://rustsec.org/advisories/RUSTSEC-2023-0011.html","https://www.openssl.org/news/secadv/20230207.txt","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=934a04f0e775309cadbef0aa6b9692e1b12a76c6","https://security.gentoo.org/glsa/202402-08","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003","https://github.com/advisories/GHSA-29xx-hcv2-c4cp"],"source_kind":"github","identifiers":["GHSA-29xx-hcv2-c4cp","CVE-2023-0216"],"repository_url":null,"blast_radius":0.0,"created_at":"2023-02-08T23:03:18.306Z","updated_at":"2026-10-14T23:15:44.159Z","epss_percentage":0.01846,"epss_percentile":0.78518,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yOXh4LWhjdjItYzRjcM4AAxfr","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0yOXh4LWhjdjItYzRjcM4AAxfr","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"300.0.12","vulnerable_version_range":"\u003e= 300.0.0, \u003c 300.0.12"}],"purl":"pkg:cargo/openssl-src"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yOXh4LWhjdjItYzRjcM4AAxfr/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12NXc2LXdjbTgtam00cc4AAxfq","url":"https://github.com/advisories/GHSA-v5w6-wcm8-jm4q","title":"openssl-src contains Double free after calling `PEM_read_bio_ex`","description":"The function `PEM_read_bio_ex()` reads a PEM file from a BIO and parses and decodes the \"name\" (e.g. \"CERTIFICATE\"), any header data and the payload data. If the function succeeds then the \"name_out\", \"header\" and \"data\" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case `PEM_read_bio_ex()` will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack.\n\nThe functions `PEM_read_bio()` and `PEM_read()` are simple wrappers around `PEM_read_bio_ex()` and therefore these functions are also directly affected.\n\nThese functions are also called indirectly by a number of other OpenSSL functions including `PEM_X509_INFO_read_bio_ex()` and\n`SSL_CTX_use_serverinfo_file()` which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if `PEM_read_bio_ex()` returns a failure code. These locations include the `PEM_read_bio_TYPE()` functions as well as the decoders introduced in OpenSSL 3.0.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2023-02-08T22:22:58.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2022-4450","https://rustsec.org/advisories/RUSTSEC-2023-0010.html","https://www.openssl.org/news/secadv/20230207.txt","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=63bcf189be73a9cc1264059bed6f57974be74a83","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=bbcf509bd046b34cca19c766bbddc31683d0858b","https://security.gentoo.org/glsa/202402-08","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003","https://github.com/advisories/GHSA-v5w6-wcm8-jm4q"],"source_kind":"github","identifiers":["GHSA-v5w6-wcm8-jm4q","CVE-2022-4450"],"repository_url":null,"blast_radius":0.0,"created_at":"2023-02-08T23:03:18.315Z","updated_at":"2026-10-03T14:12:59.135Z","epss_percentage":0.20287,"epss_percentile":0.97406,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12NXc2LXdjbTgtam00cc4AAxfq","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12NXc2LXdjbTgtam00cc4AAxfq","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"300.0.12","vulnerable_version_range":"\u003e= 300.0.0, \u003c 300.0.12"},{"first_patched_version":"111.25.0","vulnerable_version_range":"\u003c 111.25.0"}],"purl":"pkg:cargo/openssl-src"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12NXc2LXdjbTgtam00cc4AAxfq/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12eHJoLWNwZzctOHZqcs4AAxfp","url":"https://github.com/advisories/GHSA-vxrh-cpg7-8vjr","title":"openssl-src subject to NULL dereference validating DSA public key","description":"An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the `EVP_PKEY_public_check()` function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allow an attacker to cause a denial of service attack.\n\nThe TLS implementation in OpenSSL does not call this function but applications might call the function if there are additional security requirements imposed by standards such as FIPS 140-3.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2023-02-08T22:22:12.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2023-0217","https://rustsec.org/advisories/RUSTSEC-2023-0012.html","https://www.openssl.org/news/secadv/20230207.txt","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=23985bac83fd50c8e29431009302b5442f985096","https://security.gentoo.org/glsa/202402-08","https://github.com/advisories/GHSA-vxrh-cpg7-8vjr"],"source_kind":"github","identifiers":["GHSA-vxrh-cpg7-8vjr","CVE-2023-0217"],"repository_url":null,"blast_radius":0.0,"created_at":"2023-02-08T23:03:18.325Z","updated_at":"2026-10-14T23:15:44.159Z","epss_percentage":0.01846,"epss_percentile":0.78518,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12eHJoLWNwZzctOHZqcs4AAxfp","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12eHJoLWNwZzctOHZqcs4AAxfp","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"300.0.12","vulnerable_version_range":"\u003e= 300.0.0, \u003c 300.0.12"}],"purl":"pkg:cargo/openssl-src"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12eHJoLWNwZzctOHZqcs4AAxfp/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12cmg3LXg2NHYtN3Z4cc4AAxfo","url":"https://github.com/advisories/GHSA-vrh7-x64v-7vxq","title":"openssl-src contains `NULL` dereference during PKCS7 data verification","description":"A `NULL` pointer can be dereferenced when signatures are being verified on PKCS7 `signed` or `signedAndEnveloped` data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API most likely leading to a crash. The unavailability of an algorithm can be caused by using FIPS enabled configuration of providers or more commonly by not loading the legacy provider.\n\nPKCS7 data is processed by the SMIME library calls and also by the time stamp (TS) library calls. The TLS implementation in OpenSSL does not call these functions however third party applications would be affected if they call these functions to verify signatures on untrusted data.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2023-02-08T22:21:22.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2023-0401","https://rustsec.org/advisories/RUSTSEC-2023-0013.html","https://www.openssl.org/news/secadv/20230207.txt","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=d3b6dfd70db844c4499bec6ad6601623a565e674","https://security.gentoo.org/glsa/202402-08","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003","https://github.com/advisories/GHSA-vrh7-x64v-7vxq"],"source_kind":"github","identifiers":["GHSA-vrh7-x64v-7vxq","CVE-2023-0401"],"repository_url":null,"blast_radius":0.0,"created_at":"2023-02-08T23:03:18.341Z","updated_at":"2026-10-14T23:15:44.160Z","epss_percentage":0.01846,"epss_percentile":0.78518,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12cmg3LXg2NHYtN3Z4cc4AAxfo","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12cmg3LXg2NHYtN3Z4cc4AAxfo","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"300.0.12","vulnerable_version_range":"\u003e= 300.0.0, \u003c 300.0.12"}],"purl":"pkg:cargo/openssl-src"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12cmg3LXg2NHYtN3Z4cc4AAxfo/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS14NHFyLTJmdmYtM21yNc4AAxfn","url":"https://github.com/advisories/GHSA-x4qr-2fvf-3mr5","title":"Vulnerable OpenSSL included in cryptography wheels","description":"pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.8.1-39.0.0  are vulnerable to a security issue. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20221213.txt and https://www.openssl.org/news/secadv/20230207.txt.\n\nIf you are building cryptography source (\"sdist\") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2023-02-08T22:17:06.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.4,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","references":["https://github.com/pyca/cryptography/security/advisories/GHSA-x4qr-2fvf-3mr5","https://nvd.nist.gov/vuln/detail/CVE-2023-0286","https://rustsec.org/advisories/RUSTSEC-2023-0006.html","https://www.openssl.org/news/secadv/20230207.txt","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d","https://access.redhat.com/security/cve/cve-2023-0286","https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt","https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig","https://security.gentoo.org/glsa/202402-08","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003","https://github.com/advisories/GHSA-x4qr-2fvf-3mr5"],"source_kind":"github","identifiers":["GHSA-x4qr-2fvf-3mr5","CVE-2023-0286"],"repository_url":"https://github.com/pyca/cryptography","blast_radius":0.0,"created_at":"2023-02-08T23:03:18.370Z","updated_at":"2026-10-14T23:15:44.160Z","epss_percentage":0.59501,"epss_percentile":0.99029,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14NHFyLTJmdmYtM21yNc4AAxfn","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14NHFyLTJmdmYtM21yNc4AAxfn","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"300.0.12","vulnerable_version_range":"\u003e= 300.0.0, \u003c 300.0.12"},{"first_patched_version":"111.25.0","vulnerable_version_range":"\u003c 111.25.0"}],"purl":"pkg:cargo/openssl-src"},{"ecosystem":"pypi","package_name":"cryptography","versions":[{"first_patched_version":"39.0.1","vulnerable_version_range":"\u003e= 0.8.1, \u003c 39.0.1"}],"purl":"pkg:pypi/cryptography"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14NHFyLTJmdmYtM21yNc4AAxfn/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12cjhqLWhnbW0tamg5cs4AAwTC","url":"https://github.com/advisories/GHSA-vr8j-hgmm-jh9r","title":"Denial of service by double-checked locking in openssl-src","description":"If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy processing being enabled on a publicly facing server is not considered to be a common setup. Policy processing is enabled by passing the `-policy' argument to the command line utilities or by calling either `X509_VERIFY_PARAM_add0_policy()' or `X509_VERIFY_PARAM_set1_policies()' functions.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2022-12-13T18:30:33.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2022-3996","https://github.com/openssl/openssl/commit/7725e7bfe6f2ce8146b6552b44e0d226be7638e7","https://www.openssl.org/news/secadv/20221213.txt","https://github.com/advisories/GHSA-vr8j-hgmm-jh9r"],"source_kind":"github","identifiers":["GHSA-vr8j-hgmm-jh9r","CVE-2022-3996"],"repository_url":"https://github.com/openssl/openssl","blast_radius":30.939831756675396,"created_at":"2023-05-02T17:03:23.188Z","updated_at":"2026-10-14T10:09:54.014Z","epss_percentage":0.01312,"epss_percentile":0.69931,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12cjhqLWhnbW0tamg5cs4AAwTC","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12cjhqLWhnbW0tamg5cs4AAwTC","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"300.0.12","vulnerable_version_range":"\u003e= 300.0.0, \u003c 300.0.12"}],"purl":"pkg:cargo/openssl-src"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12cjhqLWhnbW0tamg5cs4AAwTC/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS04cndyLXgzN3AtbXgyM84AAvn2","url":"https://github.com/advisories/GHSA-8rwr-x37p-mx23","title":"X.509 Email Address 4-byte Buffer Overflow","description":"A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs\nafter certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to\ncontinue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address\nto overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or\npotentially remote code execution.\n\nMany platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler.\n\nPre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible.\n\nIn a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2022-11-01T17:45:59.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.8,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":["https://github.com/rustsec/advisory-db/pull/1452","https://github.com/alexcrichton/openssl-src-rs/commit/4a31c14f31e1a08c18893a37e304dd1dd4b7daa3","https://rustsec.org/advisories/RUSTSEC-2022-0064.html","https://www.openssl.org/news/secadv/20221101.txt","https://github.com/openssl/openssl/commit/fe3b639dc19b325846f4f6801f2f4604f56e3de3","https://nvd.nist.gov/vuln/detail/CVE-2022-3602","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fe3b639dc19b325846f4f6801f2f4604f56e3de3","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0023","https://security.gentoo.org/glsa/202211-01","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-W9sdCc2a","http://packetstormsecurity.com/files/169687/OpenSSL-Security-Advisory-20221101.html","http://www.openwall.com/lists/oss-security/2022/11/01/15","http://www.openwall.com/lists/oss-security/2022/11/01/16","http://www.openwall.com/lists/oss-security/2022/11/01/17","http://www.openwall.com/lists/oss-security/2022/11/01/18","http://www.openwall.com/lists/oss-security/2022/11/01/19","http://www.openwall.com/lists/oss-security/2022/11/01/20","http://www.openwall.com/lists/oss-security/2022/11/01/21","http://www.openwall.com/lists/oss-security/2022/11/01/24","http://www.openwall.com/lists/oss-security/2022/11/02/1","http://www.openwall.com/lists/oss-security/2022/11/02/10","http://www.openwall.com/lists/oss-security/2022/11/02/11","http://www.openwall.com/lists/oss-security/2022/11/02/12","http://www.openwall.com/lists/oss-security/2022/11/02/2","http://www.openwall.com/lists/oss-security/2022/11/02/3","http://www.openwall.com/lists/oss-security/2022/11/02/5","http://www.openwall.com/lists/oss-security/2022/11/02/6","http://www.openwall.com/lists/oss-security/2022/11/02/7","http://www.openwall.com/lists/oss-security/2022/11/02/9","https://www.kb.cert.org/vuls/id/794340","http://www.openwall.com/lists/oss-security/2022/11/02/13","http://www.openwall.com/lists/oss-security/2022/11/02/14","http://www.openwall.com/lists/oss-security/2022/11/02/15","http://www.openwall.com/lists/oss-security/2022/11/03/1","http://www.openwall.com/lists/oss-security/2022/11/03/2","http://www.openwall.com/lists/oss-security/2022/11/03/3","http://www.openwall.com/lists/oss-security/2022/11/03/5","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fe3b639dc19b325846f4f6801f2f4604f56e3de3","http://www.openwall.com/lists/oss-security/2022/11/03/10","http://www.openwall.com/lists/oss-security/2022/11/03/11","http://www.openwall.com/lists/oss-security/2022/11/03/6","http://www.openwall.com/lists/oss-security/2022/11/03/7","http://www.openwall.com/lists/oss-security/2022/11/03/9","https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00789.html","https://security.netapp.com/advisory/ntap-20221102-0001","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DWP23EZYOBDJQP7HP4YU7W2ABU2YDITS","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/63YRPWPUSX3MBHNPIEJZDKQT6YA7UF6S","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DWP23EZYOBDJQP7HP4YU7W2ABU2YDITS","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63YRPWPUSX3MBHNPIEJZDKQT6YA7UF6S","https://github.com/advisories/GHSA-8rwr-x37p-mx23"],"source_kind":"github","identifiers":["GHSA-8rwr-x37p-mx23","CVE-2022-3602"],"repository_url":"https://github.com/alexcrichton/openssl-src-rs","blast_radius":0.0,"created_at":"2022-12-21T16:11:54.078Z","updated_at":"2026-10-03T14:12:18.298Z","epss_percentage":0.9077,"epss_percentile":0.99793,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04cndyLXgzN3AtbXgyM84AAvn2","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS04cndyLXgzN3AtbXgyM84AAvn2","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"300.0.11","vulnerable_version_range":"\u003e= 300.0.0, \u003c 300.0.11"}],"purl":"pkg:cargo/openssl-src"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04cndyLXgzN3AtbXgyM84AAvn2/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1oOGptLTJ4NTMteGhwNc4AAvn1","url":"https://github.com/advisories/GHSA-h8jm-2x53-xhp5","title":"X.509 Email Address Variable Length Buffer Overflow","description":"A buffer overrun can be triggered in X.509 certificate verification,\nspecifically in name constraint checking. Note that this occurs after\ncertificate chain signature verification and requires either a CA to\nhave signed a malicious certificate or for an application to continue\ncertificate verification despite failure to construct a path to a trusted\nissuer. An attacker can craft a malicious email address in a certificate\nto overflow an arbitrary number of bytes containing the `.` character\n(decimal 46) on the stack. This buffer overflow could result in a crash\n(causing a denial of service).\n\nIn a TLS client, this can be triggered by connecting to a malicious\nserver. In a TLS server, this can be triggered if the server requests\nclient authentication and a malicious client connects.\n","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2022-11-01T17:45:21.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/rustsec/advisory-db/pull/1452","https://github.com/alexcrichton/openssl-src-rs/commit/4a31c14f31e1a08c18893a37e304dd1dd4b7daa3","https://rustsec.org/advisories/RUSTSEC-2022-0065.html","https://www.openssl.org/news/secadv/20221101.txt","https://github.com/openssl/openssl/commit/fe3b639dc19b325846f4f6801f2f4604f56e3de3","https://nvd.nist.gov/vuln/detail/CVE-2022-3786","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c42165b5706e42f67ef8ef4c351a9a4c5d21639a","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/63YRPWPUSX3MBHNPIEJZDKQT6YA7UF6S/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DWP23EZYOBDJQP7HP4YU7W2ABU2YDITS/","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0023","https://security.gentoo.org/glsa/202211-01","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-W9sdCc2a","http://packetstormsecurity.com/files/169687/OpenSSL-Security-Advisory-20221101.html","http://www.openwall.com/lists/oss-security/2022/11/01/15","http://www.openwall.com/lists/oss-security/2022/11/01/16","http://www.openwall.com/lists/oss-security/2022/11/01/17","http://www.openwall.com/lists/oss-security/2022/11/01/18","http://www.openwall.com/lists/oss-security/2022/11/01/19","http://www.openwall.com/lists/oss-security/2022/11/01/20","http://www.openwall.com/lists/oss-security/2022/11/01/21","http://www.openwall.com/lists/oss-security/2022/11/01/24","http://www.openwall.com/lists/oss-security/2022/11/02/1","http://www.openwall.com/lists/oss-security/2022/11/02/10","http://www.openwall.com/lists/oss-security/2022/11/02/11","http://www.openwall.com/lists/oss-security/2022/11/02/12","http://www.openwall.com/lists/oss-security/2022/11/02/2","http://www.openwall.com/lists/oss-security/2022/11/02/3","http://www.openwall.com/lists/oss-security/2022/11/02/5","http://www.openwall.com/lists/oss-security/2022/11/02/6","http://www.openwall.com/lists/oss-security/2022/11/02/7","http://www.openwall.com/lists/oss-security/2022/11/02/9","https://security.netapp.com/advisory/ntap-20221102-0001/","https://www.kb.cert.org/vuls/id/794340","http://www.openwall.com/lists/oss-security/2022/11/02/13","http://www.openwall.com/lists/oss-security/2022/11/02/14","http://www.openwall.com/lists/oss-security/2022/11/02/15","http://www.openwall.com/lists/oss-security/2022/11/03/1","http://www.openwall.com/lists/oss-security/2022/11/03/2","http://www.openwall.com/lists/oss-security/2022/11/03/3","http://www.openwall.com/lists/oss-security/2022/11/03/5","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=c42165b5706e42f67ef8ef4c351a9a4c5d21639a","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63YRPWPUSX3MBHNPIEJZDKQT6YA7UF6S/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DWP23EZYOBDJQP7HP4YU7W2ABU2YDITS/","http://www.openwall.com/lists/oss-security/2022/11/03/10","http://www.openwall.com/lists/oss-security/2022/11/03/11","http://www.openwall.com/lists/oss-security/2022/11/03/6","http://www.openwall.com/lists/oss-security/2022/11/03/7","http://www.openwall.com/lists/oss-security/2022/11/03/9","https://github.com/advisories/GHSA-h8jm-2x53-xhp5"],"source_kind":"github","identifiers":["GHSA-h8jm-2x53-xhp5","CVE-2022-3786"],"repository_url":"https://github.com/alexcrichton/openssl-src-rs","blast_radius":0.0,"created_at":"2022-12-21T16:11:54.087Z","updated_at":"2026-10-03T14:13:40.557Z","epss_percentage":0.92488,"epss_percentile":0.99813,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oOGptLTJ4NTMteGhwNc4AAvn1","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1oOGptLTJ4NTMteGhwNc4AAvn1","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"300.0.11","vulnerable_version_range":"\u003e= 300.0.0, \u003c 300.0.11"}],"purl":"pkg:cargo/openssl-src"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oOGptLTJ4NTMteGhwNc4AAvn1/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS00ZjYzLTg5dzktM2pqds4AAvPY","url":"https://github.com/advisories/GHSA-4f63-89w9-3jjv","title":"Using a Custom Cipher with `NID_undef` may lead to NULL encryption","description":"OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged to use the new provider mechanism in order to implement custom ciphers. OpenSSL versions 3.0.0 to 3.0.5 incorrectly handle legacy custom ciphers passed to the EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() and EVP_CipherInit_ex2() functions (as well as other similarly named encryption and decryption initialisation functions). Instead of using the custom cipher directly it incorrectly tries to fetch an equivalent cipher from the available providers. An equivalent cipher is found based on the NID passed to EVP_CIPHER_meth_new(). This NID is supposed to represent the unique NID for a given cipher. However it is possible for an application to incorrectly pass NID_undef as this value in the call to EVP_CIPHER_meth_new(). When NID_undef is used in this way the OpenSSL encryption/decryption initialisation function will match the NULL cipher as being equivalent and will fetch this from the available providers. This will succeed if the default provider has been loaded (or if a third party provider has been loaded that offers this cipher). Using the NULL cipher means that the plaintext is emitted as the ciphertext. Applications are only affected by this issue if they call EVP_CIPHER_meth_new() using NID_undef and subsequently use it in a call to an encryption/decryption initialisation function. Applications that only use SSL/TLS are not impacted by this issue. Fixed in OpenSSL 3.0.6 (Affected 3.0.0-3.0.5).","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2022-10-11T19:00:29.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2022-3358","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=5485c56679d7c49b96e8fc8ca708b0b7e7c03c4b","https://www.openssl.org/news/secadv/20221011.txt","https://rustsec.org/advisories/RUSTSEC-2022-0059.html","https://security.netapp.com/advisory/ntap-20221028-0014/","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0023","https://security.gentoo.org/glsa/202402-08","https://github.com/advisories/GHSA-4f63-89w9-3jjv"],"source_kind":"github","identifiers":["GHSA-4f63-89w9-3jjv","CVE-2022-3358"],"repository_url":null,"blast_radius":0.0,"created_at":"2022-12-21T16:11:55.553Z","updated_at":"2026-10-12T12:16:13.981Z","epss_percentage":0.0401,"epss_percentile":0.90294,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00ZjYzLTg5dzktM2pqds4AAvPY","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS00ZjYzLTg5dzktM2pqds4AAvPY","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"300.0.10","vulnerable_version_range":"\u003e= 300.0.0, \u003c 300.0.10"}],"purl":"pkg:cargo/openssl-src"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00ZjYzLTg5dzktM2pqds4AAvPY/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0zd3g3LTQ2Y2gtN3JxMs4AAtH0","url":"https://github.com/advisories/GHSA-3wx7-46ch-7rq2","title":"AES OCB fails to encrypt some bytes","description":"AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimized implementation will not encrypt the entirety of the data under some circumstances.  This could reveal sixteen bytes of data that was pre-existing in the memory that wasn't written.  In the special case of \"in place\" encryption, sixteen bytes of the plaintext would be revealed.\n\nSince OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2022-07-06T19:57:19.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2022-2097","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=919925673d6c9cfed3c1085497f5dfbbed5fc431","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a98f339ddd7e8f487d6e0088d4a9a42324885a93","https://rustsec.org/advisories/RUSTSEC-2022-0032.html","https://www.openssl.org/news/secadv/20220705.txt","https://security.gentoo.org/glsa/202210-02","https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf","https://www.debian.org/security/2023/dsa-5343","https://lists.debian.org/debian-lts-announce/2023/02/msg00019.html","https://security.netapp.com/advisory/ntap-20240621-0006","https://security.netapp.com/advisory/ntap-20230420-0008","https://security.netapp.com/advisory/ntap-20220715-0011","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VCMNWKERPBKOEBNL7CLTTX3ZZCZLH7XA","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V6567JERRHHJW2GNGJGKDRNHR7SNPZK7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R6CK57NBQFTPUMXAPJURCGXUYT76NQAK","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCMNWKERPBKOEBNL7CLTTX3ZZCZLH7XA","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6567JERRHHJW2GNGJGKDRNHR7SNPZK7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R6CK57NBQFTPUMXAPJURCGXUYT76NQAK","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=a98f339ddd7e8f487d6e0088d4a9a42324885a93","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=919925673d6c9cfed3c1085497f5dfbbed5fc431","https://github.com/advisories/GHSA-3wx7-46ch-7rq2"],"source_kind":"github","identifiers":["GHSA-3wx7-46ch-7rq2","CVE-2022-2097"],"repository_url":null,"blast_radius":0.0,"created_at":"2022-12-21T16:12:13.395Z","updated_at":"2026-10-14T23:16:44.174Z","epss_percentage":0.04899,"epss_percentile":0.91711,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zd3g3LTQ2Y2gtN3JxMs4AAtH0","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0zd3g3LTQ2Y2gtN3JxMs4AAtH0","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"111.22.0","vulnerable_version_range":"\u003c 111.22.0"},{"first_patched_version":"300.0.9","vulnerable_version_range":"\u003e= 300.0.0, \u003c 300.0.9"}],"purl":"pkg:cargo/openssl-src"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zd3g3LTQ2Y2gtN3JxMs4AAtH0/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS03MzVmLXBnNzYtZnhjNM4AAtFu","url":"https://github.com/advisories/GHSA-735f-pg76-fxc4","title":"openssl-src heap memory corruption with RSA private key operation","description":"The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a consequence of the memory corruption an attacker may be able to trigger a remote code execution on the machine performing the computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2022-07-02T00:00:29.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.8,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2022-2274","https://github.com/openssl/openssl/issues/18625","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=4d8a88c134df634ba610ff8db1eb8478ac5fd345","https://rustsec.org/advisories/RUSTSEC-2022-0033.html","https://www.openssl.org/news/secadv/20220705.txt","https://security.netapp.com/advisory/ntap-20220715-0010/","https://github.com/advisories/GHSA-735f-pg76-fxc4"],"source_kind":"github","identifiers":["GHSA-735f-pg76-fxc4","CVE-2022-2274"],"repository_url":"https://github.com/openssl/openssl","blast_radius":0.0,"created_at":"2022-12-21T16:12:12.015Z","updated_at":"2026-10-03T14:14:07.501Z","epss_percentage":0.45675,"epss_percentile":0.98736,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03MzVmLXBnNzYtZnhjNM4AAtFu","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS03MzVmLXBnNzYtZnhjNM4AAtFu","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"300.0.9","vulnerable_version_range":"\u003e= 300.0.8, \u003c 300.0.9"}],"purl":"pkg:cargo/openssl-src"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03MzVmLXBnNzYtZnhjNM4AAtFu/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1xOXdqLWY0cXctNnZmas4AApp0","url":"https://github.com/advisories/GHSA-q9wj-f4qw-6vfj","title":"Read buffer overruns processing ASN.1 strings","description":"ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own \"d2i\" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the \"data\" and \"length\" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the \"data\" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y).","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2022-05-24T19:12:03.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.4,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2021-3712","https://cert-portal.siemens.com/productcert/pdf/ssa-244969.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=94d23fcff9b2a7a8368dfe52214d5c2569882c11","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ccb0a11145ee72b042d10593a64eaf9e8a55ec12","https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10366","https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1@%3Cdev.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/09/msg00014.html","https://lists.debian.org/debian-lts-announce/2021/09/msg00021.html","https://www.debian.org/security/2021/dsa-4963","https://www.openssl.org/news/secadv/20210824.txt","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-16","https://www.tenable.com/security/tns-2022-02","https://rustsec.org/advisories/RUSTSEC-2021-0098.html","https://security.gentoo.org/glsa/202209-02","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20240621-0006","https://security.netapp.com/advisory/ntap-20210827-0010","https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e%40%3Cdev.tomcat.apache.org%3E","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ccb0a11145ee72b042d10593a64eaf9e8a55ec12","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=94d23fcff9b2a7a8368dfe52214d5c2569882c11","https://www.openwall.com/lists/oss-security/2021/08/26/2","https://cert-portal.siemens.com/productcert/html/ssa-389290.html","https://cert-portal.siemens.com/productcert/html/ssa-244969.html","https://cert-portal.siemens.com/productcert/html/ssa-028723.html","https://cert-portal.siemens.com/productcert/html/ssa-019200.html","https://github.com/advisories/GHSA-q9wj-f4qw-6vfj"],"source_kind":"github","identifiers":["GHSA-q9wj-f4qw-6vfj","CVE-2021-3712"],"repository_url":null,"blast_radius":0.0,"created_at":"2022-12-21T16:12:19.426Z","updated_at":"2026-10-03T14:12:59.144Z","epss_percentage":0.50445,"epss_percentile":0.98771,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xOXdqLWY0cXctNnZmas4AApp0","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1xOXdqLWY0cXctNnZmas4AApp0","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"111.16.0","vulnerable_version_range":"\u003c 111.16.0"}],"purl":"pkg:cargo/openssl-src"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xOXdqLWY0cXctNnZmas4AApp0/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS01d3c2LXB4NDItd2M4Nc4AApqI","url":"https://github.com/advisories/GHSA-5ww6-px42-wc85","title":"SM2 Decryption Buffer Overflow","description":"In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the \"out\" parameter can be NULL and, on exit, the \"outlen\" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the \"out\" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2022-05-24T19:12:03.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.8,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2021-3711","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=59f5e75f3bced8fc0e130d72a3f582cf7b480b46","https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1@%3Cdev.tomcat.apache.org%3E","https://www.debian.org/security/2021/dsa-4963","https://www.openssl.org/news/secadv/20210824.txt","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-16","https://www.tenable.com/security/tns-2022-02","http://www.openwall.com/lists/oss-security/2021/08/26/2","https://rustsec.org/advisories/RUSTSEC-2021-0097.html","https://security.gentoo.org/glsa/202209-02","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20240621-0006","https://security.netapp.com/advisory/ntap-20211022-0003","https://security.netapp.com/advisory/ntap-20210827-0010","https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e%40%3Cdev.tomcat.apache.org%3E","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=59f5e75f3bced8fc0e130d72a3f582cf7b480b46","https://github.com/advisories/GHSA-5ww6-px42-wc85"],"source_kind":"github","identifiers":["GHSA-5ww6-px42-wc85","CVE-2021-3711"],"repository_url":null,"blast_radius":0.0,"created_at":"2022-12-21T16:12:19.436Z","updated_at":"2026-10-03T14:12:59.137Z","epss_percentage":0.87816,"epss_percentile":0.9974,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01d3c2LXB4NDItd2M4Nc4AApqI","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS01d3c2LXB4NDItd2M4Nc4AApqI","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"111.16.0","vulnerable_version_range":"\u003c 111.16.0"}],"purl":"pkg:cargo/openssl-src"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01d3c2LXB4NDItd2M4Nc4AApqI/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1tZm02LXI5ZzItcTRyN83dTg","url":"https://github.com/advisories/GHSA-mfm6-r9g2-q4r7","title":"`OCSP_basic_verify` may incorrectly verify the response signing certificate","description":"The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of `OCSP_basic_verify` will not use the OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case would be 0. This issue also impacts the command line OpenSSL \"ocsp\" application. When verifying an ocsp response with the \"-no_cert_checks\" option the command line application will report that the verification is successful even though it has in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2022-05-04T00:00:23.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2022-1343","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2eda98790c5c2741d76d23cc1e74b0dc4f4b391a","https://www.openssl.org/news/secadv/20220503.txt","https://rustsec.org/advisories/RUSTSEC-2022-0027.html","https://security.netapp.com/advisory/ntap-20220602-0009/","https://github.com/github/advisory-database/issues/405","https://cert-portal.siemens.com/productcert/pdf/ssa-953464.pdf","https://github.com/advisories/GHSA-mfm6-r9g2-q4r7"],"source_kind":"github","identifiers":["GHSA-mfm6-r9g2-q4r7","CVE-2022-1343"],"repository_url":"https://github.com/github/advisory-database","blast_radius":0.0,"created_at":"2022-12-21T16:12:18.864Z","updated_at":"2026-10-03T14:14:16.680Z","epss_percentage":0.01239,"epss_percentile":0.67823,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tZm02LXI5ZzItcTRyN83dTg","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1tZm02LXI5ZzItcTRyN83dTg","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"300.0.6","vulnerable_version_range":"\u003e= 300.0.0, \u003c 300.0.6"}],"purl":"pkg:cargo/openssl-src"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tZm02LXI5ZzItcTRyN83dTg/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1nMzIzLWZyOTMtNGozY83dRw","url":"https://github.com/advisories/GHSA-g323-fr93-4j3c","title":"Resource leakage when decoding certificates and keys","description":"The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2022-05-04T00:00:22.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2022-1473","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=64c85430f95200b6b51fe9475bd5203f7c19daf1","https://www.openssl.org/news/secadv/20220503.txt","https://security.netapp.com/advisory/ntap-20220602-0009/","https://rustsec.org/advisories/RUSTSEC-2022-0025.html","https://github.com/github/advisory-database/issues/405","https://security.gentoo.org/glsa/202210-02","https://cert-portal.siemens.com/productcert/pdf/ssa-953464.pdf","https://github.com/advisories/GHSA-g323-fr93-4j3c"],"source_kind":"github","identifiers":["GHSA-g323-fr93-4j3c","CVE-2022-1473"],"repository_url":"https://github.com/github/advisory-database","blast_radius":0.0,"created_at":"2022-12-21T16:12:18.890Z","updated_at":"2026-10-03T14:12:19.823Z","epss_percentage":0.02524,"epss_percentile":0.83501,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nMzIzLWZyOTMtNGozY83dRw","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1nMzIzLWZyOTMtNGozY83dRw","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"300.0.6","vulnerable_version_range":"\u003e= 300.0.0, \u003c 300.0.6"}],"purl":"pkg:cargo/openssl-src"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nMzIzLWZyOTMtNGozY83dRw/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS02MzhtLW04bWgtN2d3Ms3dRQ","url":"https://github.com/advisories/GHSA-638m-m8mh-7gw2","title":"Incorrect MAC key used in the RC4-MD5 ciphersuite","description":"The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker could exploit this issue by performing a man-in-the-middle attack to modify data being sent from one endpoint to an OpenSSL 3.0 recipient such that the modified data would still pass the MAC integrity check. Note that data sent from an OpenSSL 3.0 endpoint to a non-OpenSSL 3.0 endpoint will always be rejected by the recipient and the connection will fail at that point. Many application protocols require data to be sent from the client to the server first. Therefore, in such a case, only an OpenSSL 3.0 server would be impacted when talking to a non-OpenSSL 3.0 client. If both endpoints are OpenSSL 3.0 then the attacker could modify data being sent in both directions. In this case both clients and servers could be affected, regardless of the application protocol. Note that in the absence of an attacker this bug means that an OpenSSL 3.0 endpoint communicating with a non-OpenSSL 3.0 endpoint will fail to complete the handshake when using this ciphersuite. The confidentiality of data is not impacted by this issue, i.e. an attacker cannot decrypt data that has been encrypted using this ciphersuite - they can only modify it. In order for this attack to work both endpoints must legitimately negotiate the RC4-MD5 ciphersuite. This ciphersuite is not compiled by default in OpenSSL 3.0, and is not available within the default provider or the default ciphersuite list. This ciphersuite will never be used if TLSv1.3 has been negotiated. In order for an OpenSSL 3.0 endpoint to use this ciphersuite the following must have occurred: 1) OpenSSL must have been compiled with the (non-default) compile time option enable-weak-ssl-ciphers 2) OpenSSL must have had the legacy provider explicitly loaded (either through application code or via configuration) 3) The ciphersuite must have been explicitly added to the ciphersuite list 4) The libssl security level must have been set to 0 (default is 1) 5) A version of SSL/TLS below TLSv1.3 must have been negotiated 6) Both endpoints must negotiate the RC4-MD5 ciphersuite in preference to any others that both endpoints have in common Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2022-05-04T00:00:22.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.9,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2022-1434","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=7d56a74a96828985db7354a55227a511615f732b","https://www.openssl.org/news/secadv/20220503.txt","https://security.netapp.com/advisory/ntap-20220602-0009/","https://rustsec.org/advisories/RUSTSEC-2022-0026.html","https://github.com/github/advisory-database/issues/405","https://cert-portal.siemens.com/productcert/pdf/ssa-953464.pdf","https://github.com/advisories/GHSA-638m-m8mh-7gw2"],"source_kind":"github","identifiers":["GHSA-638m-m8mh-7gw2","CVE-2022-1434"],"repository_url":"https://github.com/github/advisory-database","blast_radius":0.0,"created_at":"2022-12-21T16:12:18.854Z","updated_at":"2026-10-08T08:02:05.895Z","epss_percentage":0.01061,"epss_percentile":0.63513,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02MzhtLW04bWgtN2d3Ms3dRQ","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS02MzhtLW04bWgtN2d3Ms3dRQ","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"300.0.6","vulnerable_version_range":"\u003e= 300.0.0, \u003c 300.0.6"}],"purl":"pkg:cargo/openssl-src"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02MzhtLW04bWgtN2d3Ms3dRQ/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS14M21oLWp2anctM3h3eM0zKw","url":"https://github.com/advisories/GHSA-x3mh-jvjw-3xwx","title":"openssl-src's infinite loop in `BN_mod_sqrt()` reachable when parsing certificates","description":"The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc).","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2022-03-16T00:00:45.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2022-0778","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=3118eb64934499d93db3230748a452351d1d9a65","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=380085481c64de749a6dd25cdf0bcf4360b30f83","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a466912611aa6cbdf550cd10601390e587451246","https://www.openssl.org/news/secadv/20220315.txt","https://lists.debian.org/debian-lts-announce/2022/03/msg00023.html","https://lists.debian.org/debian-lts-announce/2022/03/msg00024.html","https://www.debian.org/security/2022/dsa-5103","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0002","https://www.tenable.com/security/tns-2022-06","https://www.tenable.com/security/tns-2022-07","https://www.tenable.com/security/tns-2022-08","https://rustsec.org/advisories/RUSTSEC-2022-0014.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.tenable.com/security/tns-2022-09","https://support.apple.com/kb/HT213255","https://support.apple.com/kb/HT213256","https://support.apple.com/kb/HT213257","http://seclists.org/fulldisclosure/2022/May/33","http://seclists.org/fulldisclosure/2022/May/35","http://seclists.org/fulldisclosure/2022/May/38","http://packetstormsecurity.com/files/167344/OpenSSL-1.0.2-1.1.1-3.0-BN_mod_sqrt-Infinite-Loop.html","https://cert-portal.siemens.com/productcert/pdf/ssa-712929.pdf","https://www.oracle.com/security-alerts/cpujul2022.html","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20220321-0002","https://security.netapp.com/advisory/ntap-20220429-0005","https://security.netapp.com/advisory/ntap-20240621-0006","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W6K3PR542DXWLEFFMFIDMME4CWMHJRMG","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GDB3GQVJPXJE7X5C5JN6JAA4XUDWD6E6","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/323SNN6ZX7PRJJWP2BUAFLPUAE42XWLZ","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6K3PR542DXWLEFFMFIDMME4CWMHJRMG","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GDB3GQVJPXJE7X5C5JN6JAA4XUDWD6E6","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/323SNN6ZX7PRJJWP2BUAFLPUAE42XWLZ","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=a466912611aa6cbdf550cd10601390e587451246","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=380085481c64de749a6dd25cdf0bcf4360b30f83","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3118eb64934499d93db3230748a452351d1d9a65","https://github.com/advisories/GHSA-x3mh-jvjw-3xwx"],"source_kind":"github","identifiers":["GHSA-x3mh-jvjw-3xwx","CVE-2022-0778"],"repository_url":null,"blast_radius":0.0,"created_at":"2022-12-21T16:12:29.236Z","updated_at":"2026-10-12T14:13:34.860Z","epss_percentage":0.73188,"epss_percentile":0.99411,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14M21oLWp2anctM3h3eM0zKw","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14M21oLWp2anctM3h3eM0zKw","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"111.18.0","vulnerable_version_range":"\u003c 111.18.0"},{"first_patched_version":"300.0.5","vulnerable_version_range":"\u003e= 300.0.0, \u003c 300.0.5"}],"purl":"pkg:cargo/openssl-src"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14M21oLWp2anctM3h3eM0zKw/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1tbWpmLWY1anctdzcycc0bZA","url":"https://github.com/advisories/GHSA-mmjf-f5jw-w72q","title":"Invalid handling of `X509_verify_cert()` internal errors in libssl","description":"Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error (for example out of memory). Such a negative return value is mishandled by OpenSSL and will cause an IO function (such as SSL_connect() or SSL_do_handshake()) to not indicate success and a subsequent call to SSL_get_error() to return the value SSL_ERROR_WANT_RETRY_VERIFY. This return value is only supposed to be returned by OpenSSL if the application has previously called SSL_CTX_set_cert_verify_callback(). Since most applications do not do this the SSL_ERROR_WANT_RETRY_VERIFY return value from SSL_get_error() will be totally unexpected and applications may not behave correctly as a result. The exact behaviour will depend on the application but it could result in crashes, infinite loops or other similar incorrect responses. This issue is made more serious in combination with a separate bug in OpenSSL 3.0 that will cause X509_verify_cert() to indicate an internal error when processing a certificate chain. This will occur where a certificate does not include the Subject Alternative Name extension but where a Certificate Authority has enforced name constraints. This issue can occur even with valid chains. By combining the two issues an attacker could induce incorrect, application dependent behaviour. Fixed in OpenSSL 3.0.1 (Affected 3.0.0).","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2021-12-15T00:00:42.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2021-4044","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=758754966791c537ea95241438454aa86f91f256","https://www.openssl.org/news/secadv/20211214.txt","https://rustsec.org/advisories/RUSTSEC-2021-0129.html","https://security.netapp.com/advisory/ntap-20211229-0003/","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=758754966791c537ea95241438454aa86f91f256","https://github.com/advisories/GHSA-mmjf-f5jw-w72q"],"source_kind":"github","identifiers":["GHSA-mmjf-f5jw-w72q","CVE-2021-4044"],"repository_url":null,"blast_radius":0.0,"created_at":"2022-12-21T16:12:18.874Z","updated_at":"2026-10-03T14:14:16.680Z","epss_percentage":0.50099,"epss_percentile":0.9876,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tbWpmLWY1anctdzcycc0bZA","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1tbWpmLWY1anctdzcycc0bZA","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"300.0.4","vulnerable_version_range":"\u003e= 300.0.0, \u003c 300.0.4"}],"purl":"pkg:cargo/openssl-src"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tbWpmLWY1anctdzcycc0bZA/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTgzbXgtNTczeC01cnc5","url":"https://github.com/advisories/GHSA-83mx-573x-5rw9","title":"openssl-src NULL pointer Dereference in signature_algorithms processing","description":"An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2021-08-25T20:54:02.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.9,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2021-3449","https://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fb9fa6b51defd48157eeb207f52181f735d96148","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845","https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10356","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013","https://rustsec.org/advisories/RUSTSEC-2021-0055","https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc","https://security.gentoo.org/glsa/202103-03","https://security.netapp.com/advisory/ntap-20210326-0006/","https://security.netapp.com/advisory/ntap-20210513-0002/","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd","https://www.debian.org/security/2021/dsa-4875","https://www.openssl.org/news/secadv/20210325.txt","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.tenable.com/security/tns-2021-05","https://www.tenable.com/security/tns-2021-06","https://www.tenable.com/security/tns-2021-09","https://www.tenable.com/security/tns-2021-10","http://www.openwall.com/lists/oss-security/2021/03/27/1","http://www.openwall.com/lists/oss-security/2021/03/27/2","http://www.openwall.com/lists/oss-security/2021/03/28/3","http://www.openwall.com/lists/oss-security/2021/03/28/4","https://lists.debian.org/debian-lts-announce/2021/08/msg00029.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://www.oracle.com/security-alerts/cpuapr2022.html","https://rustsec.org/advisories/RUSTSEC-2021-0055.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/advisories/GHSA-83mx-573x-5rw9"],"source_kind":"github","identifiers":["GHSA-83mx-573x-5rw9","CVE-2021-3449"],"repository_url":null,"blast_radius":0.0,"created_at":"2022-12-21T16:12:55.799Z","updated_at":"2026-10-03T14:11:59.210Z","epss_percentage":0.63542,"epss_percentile":0.99171,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTgzbXgtNTczeC01cnc5","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTgzbXgtNTczeC01cnc5","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"111.15.0","vulnerable_version_range":"\u003c 111.15.0"}],"purl":"pkg:cargo/openssl-src"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTgzbXgtNTczeC01cnc5/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLThoZmoteHJqMi1wbTIy","url":"https://github.com/advisories/GHSA-8hfj-xrj2-pm22","title":"Certificate check bypass in openssl-src","description":"The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a \"purpose\" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named \"purpose\" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j).","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2021-08-25T20:54:00.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.4,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2021-3450","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2a40b7bc7b94dd7de897a74571e7024f0cf0d63b","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845","https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10356","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/","https://mta.openssl.org/pipermail/openssl-announce/2021-March/000198.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013","https://rustsec.org/advisories/RUSTSEC-2021-0056.html","https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc","https://security.gentoo.org/glsa/202103-03","https://security.netapp.com/advisory/ntap-20210326-0006/","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd","https://www.openssl.org/news/secadv/20210325.txt","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.tenable.com/security/tns-2021-05","https://www.tenable.com/security/tns-2021-08","https://www.tenable.com/security/tns-2021-09","http://www.openwall.com/lists/oss-security/2021/03/27/1","http://www.openwall.com/lists/oss-security/2021/03/27/2","http://www.openwall.com/lists/oss-security/2021/03/28/3","http://www.openwall.com/lists/oss-security/2021/03/28/4","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/advisories/GHSA-8hfj-xrj2-pm22"],"source_kind":"github","identifiers":["GHSA-8hfj-xrj2-pm22","CVE-2021-3450"],"repository_url":null,"blast_radius":0.0,"created_at":"2022-12-21T16:12:55.791Z","updated_at":"2026-10-03T14:12:59.139Z","epss_percentage":0.18339,"epss_percentile":0.96863,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLThoZmoteHJqMi1wbTIy","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLThoZmoteHJqMi1wbTIy","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"111.15.0","vulnerable_version_range":"\u003e= 111.11.0, \u003c 111.15.0"}],"purl":"pkg:cargo/openssl-src"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLThoZmoteHJqMi1wbTIy/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTg0cm0tcWYzNy1mZ2My","url":"https://github.com/advisories/GHSA-84rm-qf37-fgc2","title":"Integer Overflow in openssl-src","description":"Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2021-08-25T20:52:21.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.9,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2021-23841","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=122a19ab48091c657f7cb1fb3af9fc07bd557bbf","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8252ee4d90f3f2004d3d0aeeed003ad49c9a7807","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9b1129239f3ebb1d1c98ce9ed41d5c9476c47cb2","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846","https://rustsec.org/advisories/RUSTSEC-2021-0058","https://security.gentoo.org/glsa/202103-03","https://security.netapp.com/advisory/ntap-20210219-0009/","https://security.netapp.com/advisory/ntap-20210513-0002/","https://support.apple.com/kb/HT212528","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212534","https://www.debian.org/security/2021/dsa-4855","https://www.openssl.org/news/secadv/20210216.txt","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.tenable.com/security/tns-2021-03","https://www.tenable.com/security/tns-2021-09","http://seclists.org/fulldisclosure/2021/May/67","http://seclists.org/fulldisclosure/2021/May/68","http://seclists.org/fulldisclosure/2021/May/70","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://rustsec.org/advisories/RUSTSEC-2021-0058.html","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/advisories/GHSA-84rm-qf37-fgc2"],"source_kind":"github","identifiers":["GHSA-84rm-qf37-fgc2","CVE-2021-23841"],"repository_url":null,"blast_radius":0.0,"created_at":"2022-12-21T16:12:55.691Z","updated_at":"2026-10-03T14:12:59.138Z","epss_percentage":0.0741,"epss_percentile":0.93973,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTg0cm0tcWYzNy1mZ2My","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTg0cm0tcWYzNy1mZ2My","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"111.14.0","vulnerable_version_range":"\u003c 111.14.0"}],"purl":"pkg:cargo/openssl-src"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTg0cm0tcWYzNy1mZ2My/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXFnbTYtOTQ3Mi1wd3E3","url":"https://github.com/advisories/GHSA-qgm6-9472-pwq7","title":"Integer Overflow in openssl-src","description":"Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2021-08-25T20:52:19.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2021-23840","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9b1129239f3ebb1d1c98ce9ed41d5c9476c47cb2","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E","https://rustsec.org/advisories/RUSTSEC-2021-0057.html","https://security.gentoo.org/glsa/202103-03","https://security.netapp.com/advisory/ntap-20210219-0009/","https://www.debian.org/security/2021/dsa-4855","https://www.openssl.org/news/secadv/20210216.txt","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.tenable.com/security/tns-2021-03","https://www.tenable.com/security/tns-2021-09","https://www.tenable.com/security/tns-2021-10","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10366","https://www.oracle.com/security-alerts/cpujan2022.html","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://www.oracle.com/security-alerts/cpuapr2022.html","https://github.com/advisories/GHSA-qgm6-9472-pwq7"],"source_kind":"github","identifiers":["GHSA-qgm6-9472-pwq7","CVE-2021-23840"],"repository_url":null,"blast_radius":0.0,"created_at":"2022-12-21T16:12:55.699Z","updated_at":"2026-10-03T14:12:59.146Z","epss_percentage":0.50732,"epss_percentile":0.98778,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXFnbTYtOTQ3Mi1wd3E3","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXFnbTYtOTQ3Mi1wd3E3","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"111.14.0","vulnerable_version_range":"\u003c 111.14.0"}],"purl":"pkg:cargo/openssl-src"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXFnbTYtOTQ3Mi1wd3E3/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWpxNjUtMjl2NC00eDM1","url":"https://github.com/advisories/GHSA-jq65-29v4-4x35","title":"Null pointer deference in openssl-src ","description":"Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the \"signature_algorithms_cert\" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2021-08-25T20:45:15.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2020-1967","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=eb563247aef3e83dda7679c43f9649270462e5b1","https://github.com/irsl/CVE-2020-1967","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440","https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee@%3Cdev.tomcat.apache.org%3E","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/","https://rustsec.org/advisories/RUSTSEC-2020-0015.html","https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc","https://security.gentoo.org/glsa/202004-10","https://security.netapp.com/advisory/ntap-20200424-0003/","https://security.netapp.com/advisory/ntap-20200717-0004/","https://www.debian.org/security/2020/dsa-4661","https://www.openssl.org/news/secadv/20200421.txt","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.synology.com/security/advisory/Synology_SA_20_05","https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL","https://www.tenable.com/security/tns-2020-03","https://www.tenable.com/security/tns-2020-04","https://www.tenable.com/security/tns-2020-11","https://www.tenable.com/security/tns-2021-10","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html","http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html","http://seclists.org/fulldisclosure/2020/May/5","http://www.openwall.com/lists/oss-security/2020/04/22/2","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://github.com/advisories/GHSA-jq65-29v4-4x35"],"source_kind":"github","identifiers":["GHSA-jq65-29v4-4x35","CVE-2020-1967"],"repository_url":"https://github.com/irsl/CVE-2020-1967","blast_radius":0.0,"created_at":"2022-12-21T16:12:54.772Z","updated_at":"2026-10-03T14:12:42.324Z","epss_percentage":0.53336,"epss_percentile":0.98849,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWpxNjUtMjl2NC00eDM1","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWpxNjUtMjl2NC00eDM1","packages":[{"ecosystem":"cargo","package_name":"openssl-src","versions":[{"first_patched_version":"111.9.0","vulnerable_version_range":"\u003e= 111.6.0, \u003c 111.9.0"}],"purl":"pkg:cargo/openssl-src"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWpxNjUtMjl2NC00eDM1/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/cargo/openssl-src","docker_dependents_count":499,"docker_downloads_count":31734304,"usage_url":"https://repos.ecosyste.ms/usage/cargo/openssl-src","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/cargo/openssl-src/dependencies","status":null,"funding_links":[],"critical":true,"issue_metadata":{"last_synced_at":"2026-10-14T06:28:22.496Z","issues_count":45,"pull_requests_count":165,"avg_time_to_close_issue":13576257.684210526,"avg_time_to_close_pull_request":1850831.3076923077,"issues_closed_count":19,"pull_requests_closed_count":156,"pull_request_authors_count":58,"issue_authors_count":41,"avg_comments_per_issue":1.1555555555555557,"avg_comments_per_pull_request":1.309090909090909,"merged_pull_requests_count":137,"bot_issues_count":0,"bot_pull_requests_count":0,"past_year_issues_count":5,"past_year_pull_requests_count":7,"past_year_avg_time_to_close_issue":131877.0,"past_year_avg_time_to_close_pull_request":156623.4,"past_year_issues_closed_count":1,"past_year_pull_requests_closed_count":5,"past_year_pull_request_authors_count":7,"past_year_issue_authors_count":4,"past_year_avg_comments_per_issue":1.6,"past_year_avg_comments_per_pull_request":1.4285714285714286,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":0,"past_year_merged_pull_requests_count":5,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexcrichton%2Fopenssl-src-rs/issues","maintainers":[{"login":"amousset","count":37,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/amousset"},{"login":"alexcrichton","count":31,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/alexcrichton"},{"login":"sfackler","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sfackler"}],"active_maintainers":[{"login":"alexcrichton","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/alexcrichton"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/packages/openssl-src/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/packages/openssl-src/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/packages/openssl-src/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/packages/openssl-src/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/packages/openssl-src/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/packages/openssl-src/codemeta","maintainers":[{"uuid":"1","login":"alexcrichton","name":"Alex Crichton","email":null,"url":"https://github.com/alexcrichton","packages_count":186,"html_url":"https://crates.io/users/alexcrichton","role":null,"created_at":"2022-11-07T22:45:19.513Z","updated_at":"2022-11-07T22:45:19.513Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/maintainers/alexcrichton/packages"},{"uuid":"5","login":"sfackler","name":"Steven Fackler","email":null,"url":"https://github.com/sfackler","packages_count":112,"html_url":"https://crates.io/users/sfackler","role":null,"created_at":"2022-11-07T22:45:19.521Z","updated_at":"2022-11-07T22:45:19.521Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/maintainers/sfackler/packages"},{"uuid":"326","login":"amousset","name":"Alexis Mousset","email":null,"url":"https://github.com/amousset","packages_count":7,"html_url":"https://crates.io/users/amousset","role":null,"created_at":"2022-11-07T22:45:19.528Z","updated_at":"2022-11-07T22:45:19.528Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/maintainers/amousset/packages"}]}