GHSA-xr7r-88qv-q7hm

Out of bounds write in serde_cbor

Source: GitHub Advisory Database (reviewed) High CVE-2019-25001

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	serde_cbor	< 0.10.2	0.10.2

Details

As written in the advisory (Markdown source, shown as plain text).

Affected versions of this crate did not properly check if semantic tags were nested excessively during deserialization. This allows an attacker to craft small (< 1 kB) CBOR documents that cause a stack overflow. The flaw was corrected by limiting the allowed number of nested tags.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-25001 advisory
https://github.com/pyfisch/cbor/pull/153 web
https://github.com/pyfisch/cbor/commit/1aec4f9d71855dbfb223fa61ca60260400cc5d5f web
https://github.com/pyfisch/cbor package
https://github.com/pyfisch/cbor/releases/tag/v0.10.2 web
https://rustsec.org/advisories/RUSTSEC-2019-0025.html web