GHSA-6ggr-cwv4-g7qg

Remotely exploitable denial of service in Rosenpass

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-53157

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	rosenpass	< 0.2.1	0.2.1

Details

As written in the advisory (Markdown source, shown as plain text).

Affected versions of this crate did not validate the size of buffers when attempting to decode messages. This allows an attacker to trigger a panic by sending a UDP datagram with a 1 byte payload over network. This flaw was corrected by validating the size of the buffers before attempting to decode the message.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-53157 advisory
https://github.com/rosenpass/rosenpass/commit/93439858d1c44294a7b377f775c4fc897a370bb2 web
https://github.com/rosenpass/rosenpass package
https://rustsec.org/advisories/RUSTSEC-2023-0077.html web