Bug 2344551 - 389-ds-base: openssl: CVE-2025-0977 / RUSTSEC-2025-0004: ssl::select_next_proto use after free
Summary: 389-ds-base: openssl: CVE-2025-0977 / RUSTSEC-2025-0004: ssl::select_next_pro...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: 389-ds-base
Version: rawhide
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: mreynolds
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: RUSTSEC-2025-0004
TreeView+ depends on / blocked
 
Reported: 2025-02-09 15:13 UTC by Fabio Valentini
Modified: 2025-02-19 15:47 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2025-02-19 15:47:54 UTC
Type: ---
Embargoed:

Attachments (Terms of Use)

Description Fabio Valentini 2025-02-09 15:13:38 UTC 
The version of the "openssl" crate bundled in this package is vulnerable to CVE-2025-0977 / RUSTSEC-2025-0004.

c.f. https://rustsec.org/advisories/RUSTSEC-2025-0004.html

Reproducible: Always
Comment 1 Viktor Ashirov 2025-02-19 15:47:54 UTC 
openssl crate is used in 389-ds-base only in pwdchan plugin for hashing
purposes:
https://github.com/389ds/389-ds-base/blob/main/src/plugins/pwdchan/Cargo.toml
https://github.com/389ds/389-ds-base/blob/main/src/plugins/pwdchan/src/lib.rs

Therefore 389-ds-base is not affected by this CVE.
Note You need to log in before you can comment on or make changes to this bug.