Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXg2N3gtdmc5bS02NWMz

Integer overflow in base64

Affected versions of this crate suffered from an integer overflow bug when
calculating the size of a buffer to use when encoding base64 using the
encode_config_buf and encode_config functions. If the input string
was large, this would cause a buffer to be allocated that was too small.
Since this function writes to the buffer using unsafe code, it would
allow an attacker to write beyond the buffer, causing memory corruption
and possibly the execution of arbitrary code.

This flaw was corrected by using checked arithmetic to calculate
the size of the buffer.

Permalink: https://github.com/advisories/GHSA-x67x-vg9m-65c3
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXg2N3gtdmc5bS02NWMz
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 2 years ago
Updated: over 1 year ago

CVSS Score: 9.8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-x67x-vg9m-65c3, CVE-2017-1000430
References:

• https://nvd.nist.gov/vuln/detail/CVE-2017-1000430
• https://github.com/alicemaz/rust-base64/commit/24ead980daf11ba563e4fb2516187a56a71ad319
• https://rustsec.org/advisories/RUSTSEC-2017-0004.html
• https://github.com/advisories/GHSA-x67x-vg9m-65c3

Repository: https://github.com/alicemaz/rust-base64
Blast Radius: 46.8

Affected Packages