PT-2023-31719 · Crypto+++2 · Crypto+++2

Roadicing

·

Publicado

2023-12-18

·

Atualizado

2024-06-15

·

CVE-2023-50981

CVSS v3.1

7.5

Alta

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Crypto++ (cryptopp) versions prior to 8.9.0
Description The issue allows attackers to cause a denial of service, specifically an infinite loop, through crafted DER public-key data associated with squared odd numbers. This can be achieved with numbers such as the square of 268995137513890432434389773128616504853.
Recommendations For versions prior to 8.9.0, update to version 8.9.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the ModularSquareRoot function in Crypto++ until a patch is applied. Avoid processing DER public-key data from untrusted sources to minimize the risk of exploitation.

Exploit

Correção

DoS

Infinite Loop

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

CVE-2023-50981
OPENSUSE-SU-2024:13550-1
OPENSUSE-SU-2024_0157-1
SUSE-SU-2024:0157-1
SUSE-SU-2024_0157-1

Produtos afetados

Crypto++
Debian
Suse