GitHub Advisoryadvisory · crates.io
GHSA-x67x-vg9m-65c3 Integer overflow in base64
CRITICAL
Official page ↗
- Aliases
- CVE-2017-1000430
- Ecosystem
- crates.io
- Packages
- base64
- Severity
- Critical
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-119
- Reviewed
- 2021-08-19
Affected packages
• crates.io base64: < 0.5.2 → fixed in 0.5.2
Description
Affected versions of this crate suffered from an integer overflow bug when
calculating the size of a buffer to use when encoding base64 using the
`encode_config_buf` and `encode_config` functions. If the input string
was large, this would cause a buffer to be allocated that was too small.
Since this function writes to the buffer using unsafe code, it would
allow an attacker to write beyond the buffer, causing memory corruption
and possibly the execution of arbitrary code.
This flaw was corrected by using checked arithmetic to calculate
the size of the buffer.
Related
Alias · CVE (1)
- CVE-2017-1000430 rust-base64 version <= 0.5.1 is vulnerable to a buffer overflow when calculating the size of a buffer to use when encoding base64 using the… vulnerability
Weakness · CWE (1)
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness