Skip to content

[Aikido] Fix critical issue in openssl via minor version upgrade from 0.10.75 to 0.10.78 in quickwit#20

Open
aikido-autofix[bot] wants to merge 1 commit into
mainfrom
fix/aikido-security-LOG-1105-update-packages-33661887-9cva
Open

[Aikido] Fix critical issue in openssl via minor version upgrade from 0.10.75 to 0.10.78 in quickwit#20
aikido-autofix[bot] wants to merge 1 commit into
mainfrom
fix/aikido-security-LOG-1105-update-packages-33661887-9cva

Conversation

@aikido-autofix
Copy link
Copy Markdown

Upgrade OpenSSL bindings to fix critical heap/stack overflow, buffer over-read, and out-of-bounds write vulnerabilities affecting cryptographic operations.

✅ 5 CVEs resolved by this upgrade, including 5 critical 🚨 CVEs

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2026-41676
🚨 CRITICAL
[openssl] A buffer overflow vulnerability in key derivation functions (X25519, X448, DH, HKDF-extract) where OpenSSL 1.1.x ignores the output buffer length, causing heap/stack overflow when callers pass short buffers. This allows remote code execution through safe code interfaces.
CVE-2026-41678
🚨 CRITICAL
[openssl] aes::unwrap_key() contains a reversed buffer size assertion that allows out-of-bounds writes when a smaller output buffer is provided, enabling memory corruption. This vulnerability affects the safe public API and can lead to arbitrary code execution or denial of service.
CVE-2026-41681
🚨 CRITICAL
[openssl] Buffer overflow in EVP_DigestFinal() allows writing past allocated buffer boundaries, corrupting stack memory and enabling remote code execution from safe Rust code. The vulnerability occurs when output buffer size is smaller than expected digest size.
CVE-2026-41898
🚨 CRITICAL
[openssl] FFI trampolines in PSK and cookie callback functions fail to validate returned usize values against buffer bounds, potentially causing buffer overflows. This can lead to memory corruption and arbitrary code execution.
CVE-2026-41677
🚨 CRITICAL
[openssl] The *_from_pem_callback APIs fail to validate callback-returned password lengths, allowing buffer over-reads in OpenSSL versions prior to 3.x. This can lead to information disclosure or denial of service through malicious password callbacks.
🔗 Related Tasks

@github-actions
Copy link
Copy Markdown

YARN is no longer allowed. Kindly replace the lockfile using PNPM. Found in ./quickwit/quickwit-ui/yarn.lock

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants