PT-2024-28635 · Unknown · Rust-Phonenumber

Rubdos · Published 2024-07-07 · Updated 2024-07-09 · CVE-2024-39697

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Name of the Vulnerable Software and Affected Versions rust-phonenumber versions 0.3.4 through 0.3.5

Description The phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form +dwPAA;phone-context=AA, where the number part potentially parses as a number larger than 2^56.

Recommendations For rust-phonenumber versions 0.3.4 through 0.3.5, upgrade to version 0.3.6 or higher to prevent panic-triggered out-of-bounds access from maliciously crafted phone numbers over the network. As a temporary workaround, consider restricting the input of phone numbers to prevent maliciously crafted strings from being processed.

Exploit

Fix

Improper Access Control

Assertion Failure

Weakness Enumeration

CWE-392

CWE-248

CWE-284

CWE-617

CWE-1284

Related Identifiers

CVE-2024-39697

GHSA-MJW4-JJ88-V687

RUSTSEC-2024-0369

Affected Products

Rust-Phonenumber

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39697.json · Exploit
• https://osv.dev/vulnerability/RUSTSEC-2024-0369 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39697 · Security Note
• https://osv.dev/vulnerability/GHSA-mjw4-jj88-v687 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-39697 · Vendor Advisory
• https://github.com/whisperfish/rust-phonenumber/issues/69 · Note
• https://github.com/whisperfish/rust-phonenumber · Note
• https://github.com/whisperfish/rust-phonenumber/commit/b792151b17fc90231c232a23935830c2266f3203 · Note
• https://github.com/whisperfish/rust-phonenumber/pull/52 · Note
• https://github.com/whisperfish/rust-phonenumber/commit/f69abee1481fac0d6d531407bae90020e39c6407 · Note
• https://github.com/whisperfish/rust-phonenumber/security/advisories/GHSA-mjw4-jj88-v687 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39697 · Note
• https://twitter.com/CVEnew/status/1810700145387868370 · Twitter Post
• https://twitter.com/CveFindCom/status/1810766116559392841 · Twitter Post
• https://rustsec.org/advisories/RUSTSEC-2024-0369.html · Note