GitHub Advisoryadvisory · crates.io

GHSA-rv9v-r4vm-gj8x Miniscript allows stack consumption

MEDIUM Published 2024-08-19 Modified 2024-09-09 Official page ↗
Aliases
CVE-2024-44073
Ecosystem
crates.io
Packages
miniscript
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-674, CWE-770, CWE-787
Reviewed
2024-08-19

Affected packages

• crates.io miniscript: >= 12.0.0, < 12.2.0 → fixed in 12.2.0 • crates.io miniscript: >= 11.0.0, < 11.2.0 → fixed in 11.2.0 • crates.io miniscript: >= 10.0.0, < 10.2.0 → fixed in 10.2.0 • crates.io miniscript: < 9.2.0 → fixed in 9.2.0

Description

The Miniscript (aka rust-miniscript) library for Rust allows stack consumption because it does not properly track tree depth.

Related

Alias · CVE (1)

  • CVE-2024-44073 The Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth. vulnerability

Weakness · CWE (3)

  • CWE-674 Uncontrolled Recursion weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness
  • CWE-787 Out-of-bounds Write weakness

References