GitHub Advisoryadvisory · crates.io

GHSA-6jmw-6mxw-w4jc BER/CER/DER decoder panics on invalid input

HIGH Published 2023-09-13 Modified 2024-09-11 Official page ↗
Aliases
CVE-2023-39914
Ecosystem
crates.io
Packages
bcder
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-228, CWE-232
Reviewed
2023-09-14

Affected packages

• crates.io bcder: < 0.7.3 → fixed in 0.7.3

Description

NLnet Labs’ bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding.

Related

Alias · CVE (1)

  • CVE-2023-39914 NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data… vulnerability

Weakness · CWE (2)

  • CWE-228 Improper Handling of Syntactically Invalid Structure weakness
  • CWE-232 Improper Handling of Undefined Values weakness

References