PT-2023-27149 · Nlnet+1 · Bcder+1

Donika Mirdita + 2 · Published 2023-09-13 · Updated 2024-09-11 · CVE-2023-39914

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NLnet Labs' bcder library versions 0.7.2 and earlier

Description The bcder library panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding.

Recommendations For versions 0.7.2 and earlier, update to version 0.7.3 or later, which fixes the issue by more thoroughly checking inputs and returning errors as expected. As a temporary workaround, consider implementing additional input validation to prevent the library from panicking when encountering invalid data.

Fix

Weakness Enumeration

CWE-228

CWE-232

CWE-240

Related Identifiers

CVE-2023-39914

GHSA-6JMW-6MXW-W4JC

RUSTSEC-2023-0062

Affected Products

Debian

Bcder

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2023-39914 · Security Note
• https://nlnetlabs.nl/downloads/bcder/CVE-2023-39914.txt · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-39914 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-39914 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-39914 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2023-0062 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-39914 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6jmw-6mxw-w4jc · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-39914 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-39914 · Security Note
• https://github.com/NLnetLabs/bcder/pull/74 · Note
• https://github.com/NLnetLabs/bcder/commit/4da91c3fd853e3d466d8581cf1d82b7f3255de56 · Note
• https://github.com/NLnetLabs/bcder · Note
• https://crates.io/crates/bcder · Note
• https://rustsec.org/advisories/RUSTSEC-2023-0062.html · Note