-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| openssl-src | rust | >= 300.0.0, < 300.0.12 | 300.0.12 |
RustRustMiggo AIRoot Cause AnalysisThe vulnerability stems from improper recursive locking in policy constraint handling. The commit diff shows the fix removed a CRYPTO_THREAD_write_lock() call in ossl_policy_cache_set_mapping, which was causing a double-lock scenario. This function is part of the policy processing logic triggered when X509_VERIFY_PARAM_add0_policy() or X509_VERIFY_PARAM_set1_policies() are used, but the actual locking vulnerability resides in ossl_policy_cache_set_mapping during certificate validation.
Ongoing coverage of React2Shell