[Pkg-rust-maintainers] Bug#1136787: rust-openssl: CVE-2026-42327

[Salvatore Bonaccorso]

Source: rust-openssl
Version: 0.10.78-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for rust-openssl.

CVE-2026-42327[0]:
| rust-openssl provides OpenSSL bindings for the Rust programming
| language. From 0.9.7 to before 0.10.79, X509Ref::ocsp_responders
| returns OCSP responder URLs from a certificate's AIA extension as
| OpensslString, whose Deref<Target = str> wraps the raw bytes with
| str::from_utf8_unchecked. OpenSSL does not enforce that the
| underlying IA5String is ASCII, so a certificate with non-UTF-8 bytes
| in its OCSP accessLocation causes safe Rust code to construct a &str
| that violates the UTF-8 invariant — resulting in undefined behavior.
| This vulnerability is fixed in 0.10.79.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-42327
    https://www.cve.org/CVERecord?id=CVE-2026-42327
[1] https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-xp3w-r5p5-63rr

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore