~ / search / GHSA-cxvp-82cq-57h2

GHSA-cxvp-82cq-57h2

blurhash panics on parsing crafted inputs

Source: GitHub Advisory Database (reviewed) High CVE-2023-42447

Packages

EcosystemPackageAffectedFixed in
crates.io blurhash >= 0.1.1, < 0.2.0 0.2.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input. In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include: - UTF-8 compliant strings containing multi-byte UTF-8 characters ### Patches The patches will be released under version 0.2.0, which requires user intervention because of slight API churn. ### Workarounds n.a. ### References n.a.

References

External links from the advisory. They lead to third-party sites.