rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions `ssl::select_next_proto` can return a slice pointing into the `server` argument's buffer but with a lifetime bound to the `client` argument. In situations where the `sever` buffer's lifetime is shorter than the `client` buffer's, this can cause a use after free. This could cause the server to crash or to return arbitrary memory contents to the client. The crate`openssl` version 0.10.70 fixes the signature of `ssl::select_next_proto` to properly constrain the output buffer's lifetime to that of both input buffers. Users are advised to upgrade. In standard usage of `ssl::select_next_proto` in the callback passed to `SslContextBuilder::set_alpn_select_callback`, code is only affected if the `server` buffer is constructed *within* the callback.

redhat RHSA-2025:7313: RHSA-2025:7313: keylime-agent-rust security update (Moderate)

redhat RHSA-2025:7317: RHSA-2025:7317: python3.12-cryptography security update (Moderate)

redhat RHSA-2025:7147: RHSA-2025:7147: rpm-ostree security update (Moderate)

redhat RHSA-2025:7241: RHSA-2025:7241: rust-bootupd security update (Moderate)

redhat RHSA-2025:7160: RHSA-2025:7160: bootc security update (Moderate)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-7313 advisory.

    [0.2.2-2]
    - Update openssl crate to version 0.10.70 to fix CVE-2025-24898

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-7317 advisory.

    - Security fix for CVE-2025-24898 in the bundled openssl crate     Resolves: RHEL-77735
    - Update to 41.0.7, fixes CVE-2023-49083

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-7147 advisory.

    [2025.5-1]
    - Rebase to 2025.5       Resolves: #RHEL-78697

    [2025.4-1]
    - Rebase to 2025.4       Resolves: #RHEL-68131

    [2025.3-1]
    - Rebase to 2025.3       Resolves: #RHEL-68131

    [2025.2-1]
    - Rebase to 2025.2       Resolves: #RHEL-68131

    [2025.1-1]
    - Rebase to 2025.1       Resolves: #RHEL-68131

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-7160 advisory.

    [1.1.6-3]
    - Backport https://github.com/containers/bootc/pull/1167
    - Resolves: #RHEL-82293

    [1.1.5-2]
    - Sync specfile from upstream
    - Resolves: #RHEL-80264
    - Resolves: #RHEL-81981

    [1.1.5-1]
    - Update to 1.1.5
    - Resolves: #RHEL-77733

    [1.1.4-2]
    - Cherry pick patches for bootc-status-updated
    - Resolves: #RHEL-72862

    [1.1.4-1]
    - Update to 1.1.4       Resolves: #RHEL-72862

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-7241 advisory.

    [0.2.27-3]
    - spec: remove ExcludeArch ix86 as this is c9s       Resolves: #RHEL-77736, #RHEL-79091

    [0.2.27-2]
    - Add git to the build requires       Resolves: #RHEL-77736, #RHEL-79091

    [0.2.27-1]
    - https://github.com/coreos/bootupd/releases/tag/v0.2.27       Resolves: #RHEL-77736

    [0.2.25-1]
    - new version

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7147 advisory.

    The rpm-ostree tool binds together the RPM packaging model with the OSTree model of bootable file system     trees. It provides commands that can be used both on client systems and on server-side composes. The rpm-     ostree-client package provides commands for client systems to perform upgrades and rollbacks.

    Security Fix(es):

    * rust-openssl: rust openssl ssl::select_next_proto use after free (CVE-2025-24898)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7160 advisory.

    Bootable container system

    Security Fix(es):

    * rust-openssl: rust openssl ssl::select_next_proto use after free (CVE-2025-24898)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:7241 advisory.

    Bootloader updater

    Security Fix(es):

    * rust-openssl: rust openssl ssl::select_next_proto use after free (CVE-2025-24898)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions     `ssl::select_next_proto` can return a slice pointing into the `server` argument's buffer but with a     lifetime bound to the `client` argument. In situations where the `sever` buffer's lifetime is shorter than     the `client` buffer's, this can cause a use after free. This could cause the server to crash or to return     arbitrary memory contents to the client. The crate`openssl` version 0.10.70 fixes the signature of     `ssl::select_next_proto` to properly constrain the output buffer's lifetime to that of both input buffers.
    Users are advised to upgrade. In standard usage of `ssl::select_next_proto` in the callback passed to     `SslContextBuilder::set_alpn_select_callback`, code is only affected if the `server` buffer is constructed
    *within* the callback. (CVE-2025-24898)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-0e5d6864d8 advisory.

    update to 1.33.2     fix  CVE-2025-24898

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-5f07738947 advisory.

    update to 1.33.2     fix  CVE-2025-24898

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4049 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4049-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Andrej Shadura     February 11, 2025                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : rust-openssl     Version        : 0.10.29-1+deb11u1     CVE ID         : CVE-2025-24898

    A vulnerability has been discovered in rust-openssl, a set of OpenSSL     bindings for the Rust programming language.

    In affected versions ssl::select_next_proto can return a slice pointing     into the server argument's buffer but with a lifetime bound to the     client argument. In situations where the sever buffer's lifetime is     shorter than the client buffer's, this can cause a use after free.

    This could cause the server to crash or to return arbitrary memory     contents to the client. This security update fixes the signature of     ssl::select_next_proto to properly constrain the output buffer's lifetime     to that of both input buffers. In standard usage of ssl::select_next_proto     in the callback passed to SslContextBuilder::set_alpn_select_callback,     code is only affected if the server buffer is constructed within the     callback.

    For Debian 11 bullseye, this problem has been fixed in version     0.10.29-1+deb11u1.

    We recommend that you upgrade your rust-openssl packages.

    For the detailed security status of rust-openssl please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/rust-openssl

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
237065	Oracle Linux 9 : keylime-agent-rust (ELSA-2025-7313)	Nessus	Oracle Linux Local Security Checks	medium
237048	Oracle Linux 9 : python3.12-cryptography (ELSA-2025-7317)	Nessus	Oracle Linux Local Security Checks	medium
237041	Oracle Linux 9 : rpm-ostree (ELSA-2025-7147)	Nessus	Oracle Linux Local Security Checks	medium
237040	Oracle Linux 9 : bootc (ELSA-2025-7160)	Nessus	Oracle Linux Local Security Checks	medium
237031	Oracle Linux 9 : rust-bootupd (ELSA-2025-7241)	Nessus	Oracle Linux Local Security Checks	medium
235816	RHEL 9 : rpm-ostree (RHSA-2025:7147)	Nessus	Red Hat Local Security Checks	medium
235799	RHEL 9 : bootc (RHSA-2025:7160)	Nessus	Red Hat Local Security Checks	medium
235798	RHEL 9 : rust-bootupd (RHSA-2025:7241)	Nessus	Red Hat Local Security Checks	medium
231327	Linux Distros Unpatched Vulnerability : CVE-2025-24898	Nessus	Misc.	medium
216671	Fedora 40 : vaultwarden (2025-0e5d6864d8)	Nessus	Fedora Local Security Checks	medium
216669	Fedora 41 : vaultwarden (2025-5f07738947)	Nessus	Fedora Local Security Checks	medium
216047	Debian dla-4049 : librust-openssl-dev - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2025-24898

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium