rust-openssl Undefined Behavior Vulnerability in OCSP Responder URL Handling

A vulnerability in rust-openssl versions 0.9.7 prior to 0.10.79 allows for undefined behavior when handling OCSP responder URLs from a certificate's AIA extension. The issue arises because the X509Ref::ocsp_responders method returns these URLs as OpensslString, which improperly assumes the raw bytes are valid UTF-8. OpenSSL does not guarantee that the underlying IA5String is ASCII, leading to the possibility of non-UTF-8 bytes causing safe Rust code to create a &str that violates the UTF-8 invariant.

Impact

This vulnerability can lead to undefined behavior in Rust applications using the affected rust-openssl version, potentially causing memory safety issues.

Remediation

Users can upgrade to rust-openssl version 0.10.79 or later to address this vulnerability.