PT-2023-27149 · Nlnet+1 · Bcder+1

Donika Mirdita + 2 · Publicado 2023-09-13 · Atualizado 2024-09-11 · CVE-2023-39914

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NLnet Labs' bcder library versions 0.7.2 and earlier

Description The bcder library panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding.

Recommendations For versions 0.7.2 and earlier, update to version 0.7.3 or later, which fixes the issue by more thoroughly checking inputs and returning errors as expected. As a temporary workaround, consider implementing additional input validation to prevent the library from panicking when encountering invalid data.

Correção

Enumeração de Fraquezas

CWE-228

CWE-232

CWE-240

Identificadores relacionados

CVE-2023-39914

GHSA-6JMW-6MXW-W4JC

RUSTSEC-2023-0062

Produtos afetados

Debian

Bcder

Referências · 19

• https://github.com/NLnetLabs/bcder/pull/74 · Nota
• https://github.com/NLnetLabs/bcder/commit/4da91c3fd853e3d466d8581cf1d82b7f3255de56 · Nota
• https://github.com/NLnetLabs/bcder · Nota
• https://crates.io/crates/bcder · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-39914 · Nota de Segurança
• https://rustsec.org/advisories/RUSTSEC-2023-0062.html · Nota
• https://nlnetlabs.nl/downloads/bcder/CVE-2023-39914.txt · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-39914 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-39914 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2023-39914 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1701969249965580411 · Publicação no Twitter
• https://t.me/cibsecurity/70392 · Publicação no Telegram
• https://osv.dev/vulnerability/RUSTSEC-2023-0062 · Aviso do Fabricante
• https://t.me/cibsecurity/70395 · Publicação no Telegram
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-39914 · Aviso do Fabricante