Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWM5cnYtM2ptcS01Mjd3

Unexpected panic when decoding tokens in branca

Prior to 0.10.0 it was possible to have both decoding functions panic unexpectedly, by supplying tokens with an incorrect base62 encoding.
The documentation stated that an error should have been reported instead.

Permalink: https://github.com/advisories/GHSA-c9rv-3jmq-527w
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWM5cnYtM2ptcS01Mjd3
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: 10 months ago

CVSS Score: 5.5
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-c9rv-3jmq-527w, CVE-2020-35918
References:

• https://nvd.nist.gov/vuln/detail/CVE-2020-35918
• https://github.com/return/branca/issues/24
• https://github.com/tuupola/branca-spec/issues/22
• https://rustsec.org/advisories/RUSTSEC-2020-0075.html
• https://github.com/return/branca/commit/7da3274bd99b05dce9c3f9b4b129d0145c71820b
• https://github.com/advisories/GHSA-c9rv-3jmq-527w

Repository: https://github.com/return/branca
Blast Radius: 11.5

Affected Packages