GitHub Advisoryadvisory · crates.io

GHSA-6ggr-cwv4-g7qg Remotely exploitable denial of service in Rosenpass

MEDIUM Published 2023-12-21 Modified 2025-07-28 Official page ↗
Aliases
CVE-2023-53157
Ecosystem
crates.io
Packages
rosenpass
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-130
Reviewed
2023-12-21

Affected packages

• crates.io rosenpass: < 0.2.1 → fixed in 0.2.1

Description

Affected versions of this crate did not validate the size of buffers when attempting to decode messages. This allows an attacker to trigger a panic by sending a UDP datagram with a 1 byte payload over network. This flaw was corrected by validating the size of the buffers before attempting to decode the message.

Related

Alias · CVE (1)

  • CVE-2023-53157 The rosenpass crate before 0.2.1 for Rust allows remote attackers to cause a denial of service (panic) via a one-byte UDP packet. vulnerability

Weakness · CWE (1)

  • CWE-130 Improper Handling of Length Parameter Inconsistency weakness

References