GitHub Advisoryadvisory · crates.io
GHSA-c9rv-3jmq-527w Unexpected panic when decoding tokens in branca
MEDIUM
Official page ↗
- Aliases
- CVE-2020-35918
- Ecosystem
- crates.io
- Packages
- branca
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-20
- Reviewed
- 2021-08-19
Affected packages
• crates.io branca: < 0.10.0 → fixed in 0.10.0
Description
Prior to 0.10.0 it was possible to have both decoding functions panic unexpectedly, by supplying tokens with an incorrect base62 encoding.
The documentation stated that an error should have been reported instead.
Related
Alias · CVE (1)
- CVE-2020-35918 An issue was discovered in the branca crate before 0.10.0 for Rust. vulnerability
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-35918 advisory
- https://github.com/return/branca/issues/24 web
- https://github.com/tuupola/branca-spec/issues/22 web
- https://github.com/return/branca/commit/7da3274bd99b05dce9c3f9b4b129d0145c71820b web
- https://github.com/return/branca package
- https://rustsec.org/advisories/RUSTSEC-2020-0075.html web