This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate solana-secp256r1-program

Dependencies

(6 total, 1 possibly insecure)

CrateRequiredLatestStatus
 bytemuck^1.21.01.22.0up to date
 openssl ⚠️^0.100.10.71maybe insecure
 solana-feature-set^2.2.12.2.4up to date
 solana-instruction^2.2.12.2.1up to date
 solana-precompile-error^2.2.12.2.1up to date
 solana-sdk-ids^2.2.12.2.1up to date

Dev dependencies

(1 total, all up-to-date)

CrateRequiredLatestStatus
 solana-logger^2.2.12.3.1up to date

Security Vulnerabilities

openssl: ssl::select_next_proto use after free

RUSTSEC-2025-0004

In openssl versions before 0.10.70, ssl::select_next_proto can return a slice pointing into the server argument's buffer but with a lifetime bound to the client argument. In situations where the server buffer's lifetime is shorter than the client buffer's, this can cause a use after free. This could cause the server to crash or to return arbitrary memory contents to the client.

openssl 0.10.70 fixes the signature of ssl::select_next_proto to properly constrain the output buffer's lifetime to that of both input buffers.

In standard usage of ssl::select_next_proto in the callback passed to SslContextBuilder::set_alpn_select_callback, code is only affected if the server buffer is constructed within the callback. For example:

Not vulnerable - the server buffer has a 'static lifetime:

builder.set_alpn_select_callback(|_, client_protos| {
    ssl::select_next_proto(b"\x02h2", client_protos).ok_or_else(AlpnError::NOACK)
});

Not vulnerable - the server buffer outlives the handshake:

let server_protos = b"\x02h2".to_vec();
builder.set_alpn_select_callback(|_, client_protos| {
    ssl::select_next_proto(&server_protos, client_protos).ok_or_else(AlpnError::NOACK)
});

Vulnerable - the server buffer is freed when the callback returns:

builder.set_alpn_select_callback(|_, client_protos| {
    let server_protos = b"\x02h2".to_vec();
    ssl::select_next_proto(&server_protos, client_protos).ok_or_else(AlpnError::NOACK)
});