The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7891-1 advisory.

    Matt Mastracci discovered that rust-openssl was incorrectly handling server lifetimes in certain     functions. An attacker could possibly use this issue to cause a denial of service or run arbitrary memory     content to the client. (CVE-2025-24898)

    It was discovered that rust-openssl was incorrectly handling empty strings when setting the host in     certain functions. An attacker could possibly use this issue to cause a denial of service. This issue only     affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-53159)

    It was discovered that rust-openssl was incorrectly handling property arguments in certain functions. An     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04     LTS. (CVE-2025-3416)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to     X509VerifyParamRef::set_host. (CVE-2023-53159)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of rust installed on the remote host is prior to 1.82.0-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2804 advisory.

    The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to     X509VerifyParamRef::set_host. (CVE-2023-53159)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
277314	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : rust-openssl vulnerabilities (USN-7891-1)	Nessus	Ubuntu Local Security Checks	medium
251336	Linux Distros Unpatched Vulnerability : CVE-2023-53159	Nessus	Misc.	critical
233789	Amazon Linux 2 : rust, --advisory ALAS2-2025-2804 (ALAS-2025-2804)	Nessus	Amazon Linux Local Security Checks	critical

Detections

Analytics

CVE-2023-53159

critical

Tenable Plugins

medium

critical

critical