Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS02am13LTZteHctdzRqY84AA12e

BER/CER/DER decoder panics on invalid input

NLnet Labs’ bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding.

Permalink: https://github.com/advisories/GHSA-6jmw-6mxw-w4jc
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02am13LTZteHctdzRqY84AA12e
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 1 year ago
Updated: 3 months ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Percentage: 0.00078
EPSS Percentile: 0.35534

Identifiers: GHSA-6jmw-6mxw-w4jc, CVE-2023-39914
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-39914
• https://nlnetlabs.nl/downloads/bcder/CVE-2023-39914.txt
• https://github.com/NLnetLabs/bcder/commit/4da91c3fd853e3d466d8581cf1d82b7f3255de56
• https://rustsec.org/advisories/RUSTSEC-2023-0062.html
• https://github.com/advisories/GHSA-6jmw-6mxw-w4jc

Repository: https://github.com/NLnetLabs/bcder
Blast Radius: 15.3

Affected Packages