~ / search / GHSA-6jmw-6mxw-w4jc

GHSA-6jmw-6mxw-w4jc

BER/CER/DER decoder panics on invalid input

Source: GitHub Advisory Database (reviewed) High CVE-2023-39914

Packages

EcosystemPackageAffectedFixed in
crates.io bcder < 0.7.3 0.7.3

Details

As written in the advisory (Markdown source, shown as plain text).

NLnet Labs’ bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding.

References

External links from the advisory. They lead to third-party sites.