प्लेटफ़ॉर्म
openssl
घटक
openssl
में ठीक किया गया
0.10.9
CVE-2018-20997 describes a critical Use-After-Free vulnerability discovered in the OpenSSL crate. This flaw allows attackers to potentially execute arbitrary code by exploiting memory corruption issues. The vulnerability affects versions of the crate prior to 0.10.9. A fix has been released in version 0.10.9.
The Use-After-Free vulnerability in OpenSSL crate allows an attacker to access or modify memory that has already been freed. This can lead to a variety of consequences, including denial of service, arbitrary code execution, and information disclosure. An attacker could potentially craft malicious inputs that trigger the vulnerability, leading to complete system compromise. The severity of this vulnerability is heightened by the widespread use of OpenSSL in various applications and systems, making it a high-priority target for attackers.
CVE-2018-20997 was publicly disclosed on June 1, 2018. While no active exploitation campaigns have been definitively linked to this specific CVE, Use-After-Free vulnerabilities are frequently targeted by attackers. The vulnerability is not currently listed on the CISA KEV catalog. Public proof-of-concept exploits may exist or emerge, increasing the risk of exploitation.
Applications and systems that rely on the OpenSSL crate, particularly those handling sensitive data or performing critical operations, are at risk. This includes Rust-based web applications, command-line tools, and embedded systems utilizing the crate for secure communication.
• rust / supply-chain: Examine dependencies for versions prior to 0.10.9 using cargo audit. Check for unusual memory access patterns in code using OpenSSL crate functions.
• generic web: Monitor application logs for crashes or errors related to OpenSSL.
• database (mysql, redis, mongodb, postgresql): If OpenSSL is used for TLS/SSL connections, check the OpenSSL version used by the database client library.
disclosure
एक्सप्लॉइट स्थिति
EPSS
0.50% (66% शतमक)
CVSS वेक्टर
The primary mitigation for CVE-2018-20997 is to upgrade to OpenSSL crate version 0.10.9 or later. If upgrading is not immediately feasible, consider implementing runtime memory safety checks or using a memory-safe alternative crate. While not a complete solution, carefully reviewing code that interacts with OpenSSL and avoiding potentially unsafe operations can reduce the attack surface. After upgrading, confirm the fix by running tests that exercise the vulnerable code paths and verifying that no crashes or unexpected behavior occurs.
कोई आधिकारिक पैच उपलब्ध नहीं है। वैकल्पिक समाधान खोजें या अपडेट की निगरानी करें।
भेद्यता विश्लेषण और गंभीर अलर्ट सीधे आपके ईमेल में।
CVE-2018-20997 is a critical vulnerability in the OpenSSL crate where memory is accessed after it has been freed, potentially leading to code execution.
You are affected if you are using the OpenSSL crate versions prior to 0.10.9. Check your project dependencies to determine if you are vulnerable.
Upgrade to OpenSSL crate version 0.10.9 or later to resolve this vulnerability. Ensure all dependent libraries are also updated.
While no confirmed active exploitation campaigns are publicly known, Use-After-Free vulnerabilities are frequently targeted, so vigilance is advised.
Refer to the OpenSSL project's security advisories and release notes for details: https://www.openssl.org/news/security/
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।