Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS04cXYyLTV2cTYtZzJnN84AA1ff

webpki: CPU denial of service in certificate path building

When this crate is given a pathological certificate chain to validate, it will spend CPU time exponential with the number of candidate certificates at each step of path building.

Both TLS clients and TLS servers that accept client certificate are affected.

This was previously reported in https://github.com/briansmith/webpki/issues/69.

rustls-webpki is a fork of this crate which contains a fix for this issue and is actively maintained.

Permalink: https://github.com/advisories/GHSA-8qv2-5vq6-g2g7
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04cXYyLTV2cTYtZzJnN84AA1ff
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 9 months ago
Updated: 7 months ago

CVSS Score: 7.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-8qv2-5vq6-g2g7
References:

• https://github.com/crypto-com/sgx-vendor
• https://rustsec.org/advisories/RUSTSEC-2023-0052.html
• https://github.com/briansmith/webpki/issues/69
• https://github.com/briansmith/webpki/issues/69#issuecomment-1699894848
• https://github.com/briansmith/webpki/commit/30a108e0802fd09585e0d071013f24b8272d139b
• https://github.com/advisories/GHSA-8qv2-5vq6-g2g7

Repository: https://github.com/crypto-com/sgx-vendor
Blast Radius: 31.8

Affected Packages