CVE-2025-24898

Date: February 3, 2025

rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions "ssl::select_next_proto" can return a slice pointing into the "server" argument's buffer but with a lifetime bound to the "client" argument. In situations where the "sever" buffer's lifetime is shorter than the "client" buffer's, this can cause a use after free. This could cause the server to crash or to return arbitrary memory contents to the client. The crate"openssl" version 0.10.70 fixes the signature of "ssl::select_next_proto" to properly constrain the output buffer's lifetime to that of both input buffers. Users are advised to upgrade. In standard usage of "ssl::select_next_proto" in the callback passed to "SslContextBuilder::set_alpn_select_callback", code is only affected if the "server" buffer is constructed within the callback.