PT-2019-14265 · Rust · Asn1 Der

Publicado 2019-06-13 · Atualizado 2021-08-25 · CVE-2019-15549

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions asn1 der crate versions prior to 0.6.2

Description The issue allows attackers to trigger memory exhaustion by supplying a large value in the length field of the ASN.1-DER length field. This is possible because affected versions of the crate tried to preallocate a vector for an arbitrary amount of bytes announced by the ASN.1-DER length field without further checks, allowing an attacker to trigger a SIGABRT by creating length fields that announce more bytes than the allocator can provide.

Recommendations For versions prior to 0.6.2, update to version 0.6.2 or later to resolve the issue. As a temporary workaround, consider implementing checks on the length field to prevent excessive memory allocation until a patch is applied.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2019-15549

GHSA-V5R6-6R3C-WQXC

RUSTSEC-2019-0007

Produtos afetados

Asn1 Der

Referências · 8

• https://github.com/KizzyCode/asn1_der/issues/1 · Nota
• https://github.com/KizzyCode/asn1_der · Nota
• https://osv.dev/vulnerability/GHSA-v5r6-6r3c-wqxc · Aviso do Fabricante
• https://osv.dev/vulnerability/RUSTSEC-2019-0007 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-15549 · Nota de Segurança
• https://rustsec.org/advisories/RUSTSEC-2019-0007.html · Nota
• https://crates.io/crates/asn1_der · Nota
• https://osv.dev/vulnerability/CVE-2019-15549 · Aviso do Fabricante