GHSA-rv9v-r4vm-gj8x
Miniscript allows stack consumption
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| crates.io | miniscript | >= 12.0.0, < 12.2.0 | 12.2.0 |
| crates.io | miniscript | >= 11.0.0, < 11.2.0 | 11.2.0 |
| crates.io | miniscript | >= 10.0.0, < 10.2.0 | 10.2.0 |
| crates.io | miniscript | < 9.2.0 | 9.2.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
The Miniscript (aka rust-miniscript) library for Rust allows stack consumption because it does not properly track tree depth.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2024-44073
- https://github.com/rust-bitcoin/rust-miniscript/pull/704
- https://github.com/rust-bitcoin/rust-miniscript/pull/712
- https://github.com/rust-bitcoin/rust-miniscript/pull/712/files
- https://github.com/rust-bitcoin/rust-miniscript/pull/713/files
- https://github.com/rust-bitcoin/rust-miniscript/pull/714/files
- https://github.com/rust-bitcoin/rust-miniscript/pull/715/files
- https://github.com/rust-bitcoin/rust-miniscript/commit/5b0f5e3417f027a22b066debf825dbe6644b575b
- https://github.com/rust-bitcoin/rust-miniscript/commit/8f54b5e3fb7129ed9fbed53f1cb9e6e62ea4c151
- https://github.com/rust-bitcoin/rust-miniscript/compare/11.2.0...12.2.0