crates.ioPackage

openssl-src

26 known vulnerabilities (13 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release: 110.0.0 (Aug 29, 2017): affected by 11 advisories
Newest unaffected release: 400.0.2+4.0.3 (Oct 1, 2026)
Advisories: 26 · 13 high, 3 medium

Weekly downloads: 2.1M
Dependents: 0
Releases: 91 since 110.0.0 (Aug 29, 2017)
Registry: crates.io
Releases read: Nov 8, 2026

Version timeline

CVE-2022-4203
Affects 300.0.0+3.0.0 to 300.0.11+3.0.7 (300.0.12+3.0.8 is outside it)
CVE-2022-4304
Affects 110.0.0 to 111.24.0+1.1.1s (111.25.0+1.1.1t is outside it); 300.0.0+3.0.0 to 300.0.11+3.0.7 (300.0.12+3.0.8 is outside it)
CVE-2022-4450
Affects 110.0.0 to 111.24.0+1.1.1s (111.25.0+1.1.1t is outside it); 300.0.0+3.0.0 to 300.0.11+3.0.7 (300.0.12+3.0.8 is outside it)
CVE-2023-0215
Affects 110.0.0 to 111.24.0+1.1.1s (111.25.0+1.1.1t is outside it); 300.0.0+3.0.0 to 300.0.11+3.0.7 (300.0.12+3.0.8 is outside it)
CVE-2023-0216
Affects 300.0.0+3.0.0 to 300.0.11+3.0.7 (300.0.12+3.0.8 is outside it)
CVE-2023-0217
Affects 300.0.0+3.0.0 to 300.0.11+3.0.7 (300.0.12+3.0.8 is outside it)
CVE-2023-0286
Affects 110.0.0 to 111.24.0+1.1.1s (111.25.0+1.1.1t is outside it); 300.0.0+3.0.0 to 300.0.11+3.0.7 (300.0.12+3.0.8 is outside it)
CVE-2023-0401
Affects 300.0.0+3.0.0 to 300.0.11+3.0.7 (300.0.12+3.0.8 is outside it)
CVE-2022-3996
Affects 300.0.0+3.0.0 to 300.0.11+3.0.7 (300.0.12+3.0.8 is outside it)
CVE-2022-3786
Affects 300.0.0+3.0.0 to 300.0.10+3.0.6 (300.0.11+3.0.7 is outside it)
CVE-2022-3602
Affects 300.0.0+3.0.0 to 300.0.10+3.0.6 (300.0.11+3.0.7 is outside it)
CVE-2022-3358
Affects 300.0.0+3.0.0 to 300.0.9+3.0.5 (300.0.10+3.0.6 is outside it)

Show all 26 advisoriesShow fewer advisories

CVE-2022-2097
Affects 110.0.0 to 111.21.0+1.1.1p (111.22.0+1.1.1q is outside it); 300.0.0+3.0.0 to 300.0.8+3.0.4 (300.0.9+3.0.5 is outside it)
CVE-2022-2274
Affects 300.0.8+3.0.4 (300.0.9+3.0.5 is outside it)
CVE-2022-1473
Affects 300.0.0+3.0.0 to 300.0.5+3.0.2 (300.0.6+3.0.3 is outside it)
CVE-2022-1434
Affects 300.0.0+3.0.0 to 300.0.5+3.0.2 (300.0.6+3.0.3 is outside it)
CVE-2022-1343
Affects 300.0.0+3.0.0 to 300.0.5+3.0.2 (300.0.6+3.0.3 is outside it)
CVE-2022-0778
Affects 110.0.0 to 111.17.0+1.1.1m (111.18.0+1.1.1n is outside it); 300.0.0+3.0.0 to 300.0.4+3.0.1 (300.0.5+3.0.2 is outside it)
CVE-2021-4044
Affects 300.0.0+3.0.0 to 300.0.3+3.0.0 (300.0.4+3.0.1 is outside it)
CVE-2021-3712
Affects 110.0.0 to 111.15.0+1.1.1k (111.16.0+1.1.1l is outside it)
CVE-2021-3711
Affects 110.0.0 to 111.15.0+1.1.1k (111.16.0+1.1.1l is outside it)
CVE-2021-3450
Affects 111.11.0+1.1.1h to 111.14.0+1.1.1j (111.15.0+1.1.1k is outside it)
CVE-2021-3449
Affects 110.0.0 to 111.14.0+1.1.1j (111.15.0+1.1.1k is outside it)
CVE-2021-23841
Affects 110.0.0 to 111.13.0+1.1.1i (111.14.0+1.1.1j is outside it)
CVE-2021-23840
Affects 110.0.0 to 111.13.0+1.1.1i (111.14.0+1.1.1j is outside it)
CVE-2020-1967
Affects 111.6.0+1.1.1d to 111.8.1+1.1.1f (111.9.0+1.1.1g is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 26

CVE-2022-4203Medium 4.9
X.509 Name Constraints Read Buffer Overflow
Affected: from 300.0.0, fixed in 300.0.12.
Fixed in 300.0.12+3.0.8 (released Feb 7, 2023, 17 days before disclosure).
The latest release, 110.0.0, is not affected.
CVE-2022-4304Medium 5.9
Timing Oracle in RSA Decryption
Affected: fixed in 111.25.0; from 300.0.0, fixed in 300.0.12; fixed in 111.25.0; from 300.0.0, fixed in 300.0.12.
Fixed in 111.25.0+1.1.1t (released Feb 7, 2023, 1 day before disclosure) and 300.0.12+3.0.8 (released Feb 7, 2023, 1 day before disclosure).
The latest release, 110.0.0, is still affected.
CVE-2022-4450High 7.5
Double free after calling PEM_read_bio_ex
Affected: fixed in 111.25.0; from 300.0.0, fixed in 300.0.12; fixed in 111.25.0; from 300.0.0, fixed in 300.0.12.
Fixed in 111.25.0+1.1.1t (released Feb 7, 2023, 1 day before disclosure) and 300.0.12+3.0.8 (released Feb 7, 2023, 1 day before disclosure).
The latest release, 110.0.0, is still affected.
CVE-2023-0215High 7.5
Use-after-free following BIO_new_NDEF
Affected: fixed in 111.25.0; from 300.0.0, fixed in 300.0.12; fixed in 111.25.0; from 300.0.0, fixed in 300.0.12.
Fixed in 111.25.0+1.1.1t (released Feb 7, 2023, 1 day before disclosure) and 300.0.12+3.0.8 (released Feb 7, 2023, 1 day before disclosure).
The latest release, 110.0.0, is still affected.
CVE-2023-0216High 7.5
Invalid pointer dereference in d2i_PKCS7 functions
Affected: from 300.0.0, fixed in 300.0.12.
Fixed in 300.0.12+3.0.8 (released Feb 7, 2023, 1 day before disclosure).
The latest release, 110.0.0, is not affected.
CVE-2023-0217High 7.5
NULL dereference validating DSA public key
Affected: from 300.0.0, fixed in 300.0.12.
Fixed in 300.0.12+3.0.8 (released Feb 7, 2023, 1 day before disclosure).
The latest release, 110.0.0, is not affected.
CVE-2023-0286High 7.4
X.400 address type confusion in X.509 GeneralName
Affected: fixed in 111.25.0; from 300.0.0, fixed in 300.0.12; fixed in 111.25.0; from 300.0.0, fixed in 300.0.12.
Fixed in 111.25.0+1.1.1t (released Feb 7, 2023, 1 day before disclosure) and 300.0.12+3.0.8 (released Feb 7, 2023, 1 day before disclosure).
The latest release, 110.0.0, is still affected.
CVE-2023-0401High 7.5
NULL dereference during PKCS7 data verification
Affected: from 300.0.0, fixed in 300.0.12.
Fixed in 300.0.12+3.0.8 (released Feb 7, 2023, 1 day before disclosure).
The latest release, 110.0.0, is not affected.
CVE-2022-3996High 7.5
X.509 Policy Constraints Double Locking
Affected: from 300.0.0, fixed in 300.0.12.
Fixed in 300.0.12+3.0.8 (released Feb 7, 2023, 56 days after disclosure).
The latest release, 110.0.0, is not affected.
CVE-2022-3786High 7.5
X.509 Email Address Variable Length Buffer Overflow
Affected: from 300.0.0, fixed in 300.0.11.
Fixed in 300.0.11+3.0.7 (released Nov 1, 2022, the day of disclosure).
The latest release, 110.0.0, is not affected.
CVE-2022-3602High 7.5
X.509 Email Address 4-byte Buffer Overflow
Affected: from 300.0.0, fixed in 300.0.11.
Fixed in 300.0.11+3.0.7 (released Nov 1, 2022, the day of disclosure).
The latest release, 110.0.0, is not affected.
CVE-2022-3358Unrated
Using a Custom Cipher with NID_undef may lead to NULL encryption
Affected: from 300.0.0, fixed in 300.0.10.
Fixed in 300.0.10+3.0.6 (released Oct 11, 2022, the day of disclosure).
The latest release, 110.0.0, is not affected.
CVE-2022-2097Unrated
AES OCB fails to encrypt some bytes
Affected: fixed in 111.22.0; from 300.0.0, fixed in 300.0.9; fixed in 111.22.0; from 300.0.0, fixed in 300.0.9.
Fixed in 111.22.0+1.1.1q (released Jul 5, 2022, the day of disclosure) and 300.0.9+3.0.5 (released Jul 5, 2022, the day of disclosure).
The latest release, 110.0.0, is still affected.
CVE-2022-2274Unrated
RSA implementation bug in AVX512IFMA instructions
Affected: from 300.0.8, fixed in 300.0.9.
Fixed in 300.0.9+3.0.5 (released Jul 5, 2022, 4 days after disclosure).
The latest release, 110.0.0, is not affected.
CVE-2022-1473High 7.5
Resource leakage when decoding certificates and keys
Affected: from 300.0.0, fixed in 300.0.6.
Fixed in 300.0.6+3.0.3 (released May 5, 2022, 2 days after disclosure).
The latest release, 110.0.0, is not affected.

Show all 26 advisoriesShow fewer advisories

CVE-2022-1434Unrated
Incorrect MAC key used in the RC4-MD5 ciphersuite
Affected: from 300.0.0, fixed in 300.0.6.
Fixed in 300.0.6+3.0.3 (released May 5, 2022, 2 days after disclosure).
The latest release, 110.0.0, is not affected.
CVE-2022-1343Medium 5.3
OCSP_basic_verify may incorrectly verify the response signing certificate
Affected: from 300.0.0, fixed in 300.0.6.
Fixed in 300.0.6+3.0.3 (released May 5, 2022, 2 days after disclosure).
The latest release, 110.0.0, is not affected.
CVE-2022-0778High 7.5
Infinite loop in BN_mod_sqrt() reachable when parsing certificates
Affected: from 300.0.0, fixed in 300.0.5; fixed in 111.18.0; fixed in 111.18.0; from 300.0.0, fixed in 300.0.5.
Fixed in 111.18.0+1.1.1n (released Mar 16, 2022, 1 day after disclosure) and 300.0.5+3.0.2 (released Mar 16, 2022, 1 day after disclosure).
The latest release, 110.0.0, is still affected.
CVE-2021-4044Unrated
Invalid handling of X509_verify_cert() internal errors in libssl
Affected: from 300.0.0, fixed in 300.0.4.
Fixed in 300.0.4+3.0.1 (released Dec 14, 2021, the day of disclosure).
The latest release, 110.0.0, is not affected.
CVE-2021-3712High 7.4
Read buffer overruns processing ASN.1 strings
Affected: fixed in 111.16.0; fixed in 111.16.0.
Fixed in 111.16.0+1.1.1l (released Aug 24, 2021, the day of disclosure).
The latest release, 110.0.0, is still affected.
CVE-2021-3711Unrated
SM2 Decryption Buffer Overflow
Affected: fixed in 111.16.0; fixed in 111.16.0.
Fixed in 111.16.0+1.1.1l (released Aug 24, 2021, the day of disclosure).
The latest release, 110.0.0, is still affected.
CVE-2021-3450Unrated
CA certificate check bypass with X509_V_FLAG_X509_STRICT
Affected: from 111.11.0, fixed in 111.15.0.
Fixed in 111.15.0+1.1.1k (released Mar 25, 2021, the day of disclosure).
The latest release, 110.0.0, is not affected.
CVE-2021-3449Unrated
NULL pointer deref in signature_algorithms processing
Affected: fixed in 111.15.0; fixed in 111.15.0.
Fixed in 111.15.0+1.1.1k (released Mar 25, 2021, the day of disclosure).
The latest release, 110.0.0, is still affected.
CVE-2021-23841Unrated
Null pointer deref in X509_issuer_and_serial_hash()
Affected: fixed in 111.14.0; fixed in 111.14.0.
Fixed in 111.14.0+1.1.1j (released Feb 18, 2021, 2 days after disclosure).
The latest release, 110.0.0, is still affected.
CVE-2021-23840High 7.5
Integer overflow in CipherUpdate
Affected: fixed in 111.14.0; fixed in 111.14.0.
Fixed in 111.14.0+1.1.1j (released Feb 18, 2021, 2 days after disclosure).
The latest release, 110.0.0, is still affected.
CVE-2020-1967Unrated
Segmentation fault in SSL_check_chain
Affected: from 111.6.0, fixed in 111.9.0.
Fixed in 111.9.0+1.1.1g (released Apr 21, 2020, the day of disclosure).
The latest release, 110.0.0, is not affected.