CVE-2023-53159: sfackler openssl Buffer Over-read
CVSS: 4.5v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2023-53159DEBIAN-CVE-2023-53159CGA-hqxg-p276-fm5jCGA-m7mv-jmw4-g8pvGHSA-xcf7-rvmh-g6q4RUSTSEC-2023-0044
Published 28-07-2025Last modified 28-07-2025
Vulnerability summary
CVE-2023-53159 is a medium (CVSS 4.5) Buffer Over-read vulnerability in sfackler openssl. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.8% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
4.5/10
010
Medium · v3.1 (CVE.org)EPSS score
0.21%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 28-07-2025PublishedVulnerability first disclosed.
- 28-07-2025Last modifiedVulnerability information updated.
Description
The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.
CVSS metrics
7 scores · 7 sources · 1 versionMedium 4.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:LSources7 sources · 3.3–4.5
- OSV · UbuntuEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NDiffers
- OSV · DebianEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NDiffers
- OSV · WolfiEcosystem advisory · calculated4.5MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L
- OSV · ChainguardEcosystem advisory · calculated4.5MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L
- OSV · Crates.ioEcosystem advisory · calculated4.5MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L
- NVDNIST3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NDiffers
EPSS trend
Probability
0.21%
Chance of exploitation in the next 30 days
Percentile
11%
Versus all other CVEs
30-day change
+0.02 pp
From 0.19% on 19-09-2026
19-09-202619-10-2026
EPSS score0.21%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundRust Openssl
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard1 product
- berg< 0.3.5-r2
Crates.Io1 product
- openssl≥ 0.10.0, < 0.10.55 | ≥ 0.0.0-0, < 0.10.55
Debian1 product
- rust-opensslAll versions (No fix recorded) | < 0.10.57-1
Sfackler1 product
- openssl< 0.10.55
Ubuntu1 product
- rust-openssl< 0.10.23-1ubuntu0.1~esm1 | < 0.10.36-1ubuntu0.1~esm1
Wolfi1 product
- berg< 0.3.5-r2
6 vendors · 6 products
