GitHub Advisoryadvisory · crates.io

GHSA-5873-6fwq-463f stellar-strkey vulnerable to panic in SignedPayload::from_payload

MEDIUM Published 2023-10-25 Modified 2023-10-25 Official page ↗
Aliases
CVE-2023-46135
Ecosystem
crates.io
Packages
stellar-strkey
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-248
Reviewed
2023-10-25

Affected packages

• crates.io stellar-strkey: < 0.0.8 → fixed in 0.0.8

Description

Impact Panic vulnerability when a specially crafted payload is used. This is because of the following calculation: ```rust inner_payload_len + (4 - inner_payload_len % 4) % 4 ``` If `inner_payload_len` is `0xffffffff`, `(4 - inner_payload_len % 4) % 4 = 1` so ```rust inner_payload_len + (4 - inner_payload_len % 4) % 4 = u32::MAX + 1 ``` which overflow. Patches Check that `inner_payload_len` is not above 64 which should never be the case. Patched in version 0.0.8 Workarounds Sanitize input payload before it is passed to the vulnerable function so that bytes in `payload[32..32+4]` and parsed as a `u32` is not above 64. References GitHub issue #58

Related

Alias · CVE (1)

  • CVE-2023-46135 rs-stellar-strkey is a Rust lib for encode/decode of Stellar Strkeys. vulnerability

Weakness · CWE (1)

  • CWE-248 Uncaught Exception weakness

References