rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions `ssl::select_next_proto` can return a slice pointing into the `server` argument's buffer but with a lifetime bound to the `client` argument. In situations where the `sever` buffer's lifetime is shorter than the `client` buffer's, this can cause a use after free. This could cause the server to crash or to return arbitrary memory contents to the client. The crate`openssl` version 0.10.70 fixes the signature of `ssl::select_next_proto` to properly constrain the output buffer's lifetime to that of both input buffers. Users are advised to upgrade. In standard usage of `ssl::select_next_proto` in the callback passed to `SslContextBuilder::set_alpn_select_callback`, code is only affected if the `server` buffer is constructed *within* the callback.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions     `ssl::select_next_proto` can return a slice pointing into the `server` argument's buffer but with a     lifetime bound to the `client` argument. In situations where the `sever` buffer's lifetime is shorter than     the `client` buffer's, this can cause a use after free. This could cause the server to crash or to return     arbitrary memory contents to the client. The crate`openssl` version 0.10.70 fixes the signature of     `ssl::select_next_proto` to properly constrain the output buffer's lifetime to that of both input buffers.
    Users are advised to upgrade. In standard usage of `ssl::select_next_proto` in the callback passed to     `SslContextBuilder::set_alpn_select_callback`, code is only affected if the `server` buffer is constructed
    *within* the callback. (CVE-2025-24898)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-0e5d6864d8 advisory.

    update to 1.33.2     fix  CVE-2025-24898

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-5f07738947 advisory.

    update to 1.33.2     fix  CVE-2025-24898

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4049 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4049-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Andrej Shadura     February 11, 2025                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : rust-openssl     Version        : 0.10.29-1+deb11u1     CVE ID         : CVE-2025-24898

    A vulnerability has been discovered in rust-openssl, a set of OpenSSL     bindings for the Rust programming language.

    In affected versions ssl::select_next_proto can return a slice pointing     into the server argument's buffer but with a lifetime bound to the     client argument. In situations where the sever buffer's lifetime is     shorter than the client buffer's, this can cause a use after free.

    This could cause the server to crash or to return arbitrary memory     contents to the client. This security update fixes the signature of     ssl::select_next_proto to properly constrain the output buffer's lifetime     to that of both input buffers. In standard usage of ssl::select_next_proto     in the callback passed to SslContextBuilder::set_alpn_select_callback,     code is only affected if the server buffer is constructed within the     callback.

    For Debian 11 bullseye, this problem has been fixed in version     0.10.29-1+deb11u1.

    We recommend that you upgrade your rust-openssl packages.

    For the detailed security status of rust-openssl please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/rust-openssl

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
231327	Linux Distros Unpatched Vulnerability : CVE-2025-24898	Nessus	Misc.	medium
216671	Fedora 40 : vaultwarden (2025-0e5d6864d8)	Nessus	Fedora Local Security Checks	medium
216669	Fedora 41 : vaultwarden (2025-5f07738947)	Nessus	Fedora Local Security Checks	medium
216047	Debian dla-4049 : librust-openssl-dev - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2025-24898

medium

Tenable Plugins

medium

medium

medium

medium