Debian Package Tracker
Register | Log in
Subscribe

rust-openssl

OpenSSL bindings - Rust source code

Choose email to subscribe with

general
  • source: rust-openssl (main)
  • version: 0.10.72-1
  • maintainer: Debian Rust Maintainers (archive) (DMD)
  • uploaders: Ximin Luo [DMD]
  • arch: any
  • std-ver: 4.7.0
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • o-o-stable: 0.10.16-1
  • oldstable: 0.10.29-1
  • old-sec: 0.10.29-1+deb11u1
  • stable: 0.10.45-1
  • testing: 0.10.72-1
  • unstable: 0.10.72-1
versioned links
  • 0.10.16-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 0.10.29-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 0.10.29-1+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 0.10.45-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 0.10.72-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • librust-openssl-dev
action needed
2 low-priority security issues in bookworm low

There are 2 open security issues in bookworm.

2 issues left for the package maintainer to handle:
  • CVE-2025-3416: (needs triaging) A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string.
  • CVE-2025-24898: (needs triaging) rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions `ssl::select_next_proto` can return a slice pointing into the `server` argument's buffer but with a lifetime bound to the `client` argument. In situations where the `sever` buffer's lifetime is shorter than the `client` buffer's, this can cause a use after free. This could cause the server to crash or to return arbitrary memory contents to the client. The crate`openssl` version 0.10.70 fixes the signature of `ssl::select_next_proto` to properly constrain the output buffer's lifetime to that of both input buffers. Users are advised to upgrade. In standard usage of `ssl::select_next_proto` in the callback passed to `SslContextBuilder::set_alpn_select_callback`, code is only affected if the `server` buffer is constructed *within* the callback.

You can find information about how to handle these issues in the security team's documentation.

Created: 2024-04-04 Last update: 2025-04-22 17:00
debian/patches: 3 patches to forward upstream low

Among the 3 debian patches available in version 0.10.72-1 of the package, we noticed the following issues:

  • 3 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.
Created: 2023-02-26 Last update: 2025-04-08 16:32
Build log checks report 2 warnings low
Build log checks report 2 warnings
Created: 2018-08-03 Last update: 2024-03-21 21:17
Standards version of the package is outdated. wishlist
The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.2 instead of 4.7.0).
Created: 2025-02-21 Last update: 2025-04-08 10:26
news
[rss feed]
  • [2025-04-14] rust-openssl 0.10.72-1 MIGRATED to testing (Debian testing watch)
  • [2025-04-08] Accepted rust-openssl 0.10.72-1 (source) into unstable (Peter Michael Green)
  • [2025-02-12] rust-openssl 0.10.70-1 MIGRATED to testing (Debian testing watch)
  • [2025-02-11] Accepted rust-openssl 0.10.29-1+deb11u1 (source) into oldstable-security (Andrej Shadura) (signed by: Andrew Shadura)
  • [2025-02-06] Accepted rust-openssl 0.10.70-1 (source) into unstable (Peter Michael Green)
  • [2024-12-29] rust-openssl 0.10.68-1 MIGRATED to testing (Debian testing watch)
  • [2024-12-27] Accepted rust-openssl 0.10.68-1 (source) into unstable (Peter Michael Green)
  • [2024-03-26] rust-openssl 0.10.64-1 MIGRATED to testing (Debian testing watch)
  • [2024-03-09] Accepted rust-openssl 0.10.64-1 (source) into unstable (Peter Michael Green)
  • [2023-09-12] rust-openssl 0.10.57-1 MIGRATED to testing (Debian testing watch)
  • [2023-09-07] Accepted rust-openssl 0.10.57-1 (source) into unstable (Peter Michael Green)
  • [2023-01-06] rust-openssl 0.10.45-1 MIGRATED to testing (Debian testing watch)
  • [2022-12-31] Accepted rust-openssl 0.10.45-1 (source) into unstable (Peter Michael Green)
  • [2022-09-28] Accepted rust-openssl 0.10.41-1 (source) into experimental (Fabian Grünbichler) (signed by: James McCoy)
  • [2021-12-26] rust-openssl 0.10.36-1 MIGRATED to testing (Debian testing watch)
  • [2021-10-23] Accepted rust-openssl 0.10.36-1 (source) into unstable (Ximin Luo) (signed by: infinity0@debian.org)
  • [2020-04-24] rust-openssl 0.10.29-1 MIGRATED to testing (Debian testing watch)
  • [2020-04-18] Accepted rust-openssl 0.10.29-1 (source) into unstable (Ximin Luo) (signed by: infinity0@debian.org)
  • [2020-03-16] rust-openssl REMOVED from testing (Debian testing watch)
  • [2019-07-09] rust-openssl 0.10.23-1 MIGRATED to testing (Debian testing watch)
  • [2019-05-31] Accepted rust-openssl 0.10.23-1 (source) into unstable (Ximin Luo)
  • [2019-01-01] rust-openssl 0.10.16-1 MIGRATED to testing (Debian testing watch)
  • [2018-12-26] Accepted rust-openssl 0.10.16-1 (source) into unstable (Ximin Luo)
  • [2018-12-19] rust-openssl 0.10.10-1 MIGRATED to testing (Debian testing watch)
  • [2018-08-03] Accepted rust-openssl 0.10.10-1 (amd64 source) into unstable, unstable (Ximin Luo)
bugs [bug history graph]
  • all: 1
  • RC: 0
  • I&N: 1
  • M&W: 0
  • F&P: 0
  • patch: 0
links
  • homepage
  • lintian
  • buildd: logs, checks, reproducibility, cross
  • popcon
  • browse source code
  • edit tags
  • other distros
  • security tracker
  • debian patches
  • debci
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 0.10.70-1

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing