Medium ALAS2-2025-2804 1 CVE

Moderate: rust security update (Amazon Linux 2)

Published Mar 20, 2025 · Updated Sep 23, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-53159: The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.

Fixed packages 12

Release	Package	Fixed in
Amazon Linux · 2	cargo	0:1.82.0-4.amzn2.0.2
Amazon Linux · 2	clippy	0:1.82.0-4.amzn2.0.2
Amazon Linux · 2	rust	0:1.82.0-4.amzn2.0.2
Amazon Linux · 2	rust-analyzer	0:1.82.0-4.amzn2.0.2
Amazon Linux · 2	rust-debugger-common	0:1.82.0-4.amzn2.0.2
Amazon Linux · 2	rust-doc	0:1.82.0-4.amzn2.0.2
Amazon Linux · 2	rust-gdb	0:1.82.0-4.amzn2.0.2
Amazon Linux · 2	rust-src	0:1.82.0-4.amzn2.0.2
Amazon Linux · 2	rust-std-static	0:1.82.0-4.amzn2.0.2
Amazon Linux · 2	rust-toolset	0:1.82.0-4.amzn2.0.2
Amazon Linux · 2	rust-toolset-srpm-macros	0:1.82.0-4.amzn2.0.2
Amazon Linux · 2	rustfmt	0:1.82.0-4.amzn2.0.2

Vulnerabilities 1

Medium 4.5

CVE-2023-53159

`openssl` `X509VerifyParamRef::set_host` buffer over-read

The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.

sfackler openssl openssl rust-openssl Debian Ubuntu Wolfi crates.io

Jul 28, 2025

References

web
https://alas.aws.amazon.com/cve/html/CVE-2023-53159.html