GHSA-6jmw-6mxw-w4jc

ghsaUSosv

BER/CER/DER decoder panics on invalid input

view advisory published 2023-09-13Licence: CC-BY-4.0

NLnet Labs’ bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-39914US	high7.5	0.70% (53rd)	—	2023-09-13
NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the…

references

External citations — patches, advisories, analysis.

https://github.com/NLnetLabs/bcderPACKAGE
https://github.com/NLnetLabs/bcder/commit/4da91c3fd853e3d466d8581cf1d82b7f3255de56WEB
https://nlnetlabs.nl/downloads/bcder/CVE-2023-39914.txtWEB
https://nvd.nist.gov/vuln/detail/CVE-2023-39914ADVISORY
https://rustsec.org/advisories/RUSTSEC-2023-0062.htmlWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan