PT-2019-14265 · Rust · Asn1 Der

Published 2019-06-13 · Updated 2021-08-25 · CVE-2019-15549

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions asn1 der crate versions prior to 0.6.2

Description The issue allows attackers to trigger memory exhaustion by supplying a large value in the length field of the ASN.1-DER length field. This is possible because affected versions of the crate tried to preallocate a vector for an arbitrary amount of bytes announced by the ASN.1-DER length field without further checks, allowing an attacker to trigger a SIGABRT by creating length fields that announce more bytes than the allocator can provide.

Recommendations For versions prior to 0.6.2, update to version 0.6.2 or later to resolve the issue. As a temporary workaround, consider implementing checks on the length field to prevent excessive memory allocation until a patch is applied.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2019-15549

GHSA-V5R6-6R3C-WQXC

RUSTSEC-2019-0007

Affected Products

Asn1 Der

References · 8

• https://osv.dev/vulnerability/GHSA-v5r6-6r3c-wqxc · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2019-0007 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15549 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15549 · Vendor Advisory
• https://github.com/KizzyCode/asn1_der/issues/1 · Note
• https://github.com/KizzyCode/asn1_der · Note
• https://rustsec.org/advisories/RUSTSEC-2019-0007.html · Note
• https://crates.io/crates/asn1_der · Note