The rust-openssl library, which provides OpenSSL bindings for Rust, contains a buffer sizing flaw in versions 0.10.50 through 0.10.79 in the CipherCtxRef::cipher_update_inplace function. When used with AES key-wrap-with-padding ciphers (EVP_aes_{128,192,256}_wrap_pad), the function incorrectly sizes output buffers. For plaintext inputs whose length is not a multiple of 8, OpenSSL may write up to 7 bytes beyond the allocated buffer, causing heap corruption that can be influenced by an attacker. This vulnerability is resolved in rust-openssl version 0.10.80.

This vulnerability allows an attacker who can control the plaintext length to cause heap corruption by triggering out-of-bounds writes of up to 7 bytes beyond the buffer. The corruption can lead to denial of service or potentially arbitrary code execution. The CVSS 3.1 score is 7.1 (medium severity) with local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and high availability impact.

A fix is available in rust-openssl version 0.10.80. Users should upgrade to version 0.10.80 or later to remediate this vulnerability. No vendor advisory indicates alternative mitigations or that no action is required.