GitHub Advisoryadvisory · crates.io

GHSA-25mx-8f3v-8wh7 sequoia-openpgp vulnerable to out-of-bounds array access leading to panic

LOW Published 2023-06-06 Modified 2025-07-28 Official page ↗
Aliases
CVE-2023-53160
Ecosystem
crates.io
Packages
sequoia-openpgp
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-125
Reviewed
2023-06-06

Affected packages

• crates.io sequoia-openpgp: < 1.1.1 → fixed in 1.1.1 • crates.io sequoia-openpgp: >= 1.2.0, < 1.8.1 → fixed in 1.8.1 • crates.io sequoia-openpgp: >= 1.9.0, < 1.16.0 → fixed in 1.16.0

Description

Affected versions of the crate have several bugs where attacker-controlled input can result in the use of an out-of-bound array index. Rust detects the use of the out-of-bound index and causes the application to panic. An attacker may be able to use this to cause a denial-of-service. However, it is not possible for an attacker to read from or write to the application's address space.

Related

Alias · CVE (1)

  • CVE-2023-53160 The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic. vulnerability

Weakness · CWE (1)

  • CWE-125 Out-of-bounds Read weakness

References