PT-2024-35953 · Rpgp · Rpgp

Dignifiedquire + 2 · Published 2024-12-05 · Updated 2024-12-06 · CVE-2024-53856

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: rPGP versions prior to 0.14.1

Description: The issue allows an attacker to trigger crashes in rPGP by providing crafted data. This can occur in various scenarios, including parsing OpenPGP messages, decrypting messages via decrypt with password(), parsing or converting public keys, parsing signed cleartext messages, and using malformed private keys to sign or encrypt. The attack complexity is considered low, and the result is a denial-of-service impact via program termination, with no impact to confidentiality or integrity security properties.

Recommendations: For versions prior to 0.14.1, upgrade to version 0.14.1 to fix the issue. As a temporary workaround, consider restricting the use of vulnerable components, such as decrypt with password(), until the patch is applied. Avoid using malformed private keys to sign or encrypt until the issue is resolved.

Exploit

Fix

Assertion Failure

Weakness Enumeration

CWE-248

CWE-130

CWE-617

CWE-148

Related Identifiers

CVE-2024-53856

GHSA-9RMP-2568-59RV

RUSTSEC-2024-0447

Affected Products

Rpgp

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53856.json · Exploit
• https://security-tracker.debian.org/tracker/CVE-2024-53856 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9rmp-2568-59rv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53856 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2024-0447 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-53856 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-53856 · Vendor Advisory
• https://github.com/rpgp/rpgp · Note
• https://github.com/rpgp/rpgp/security/advisories/GHSA-9rmp-2568-59rv · Note
• https://github.com/radicallyopensecurity/ros-website/blob/8169b16fc138a0b0dde14dd0e222d1279701b4d3/ros-public-reports/ROS%20-%20NLNet%20-%20rPGP%20-%202024.pdf · Note
• https://twitter.com/VulmonFeeds/status/1864832113976984048 · Twitter Post
• https://t.me/latest_high_impact_cve/1614 · Telegram Post
• https://twitter.com/CVEnew/status/1864698941842846145 · Twitter Post
• https://rustsec.org/advisories/RUSTSEC-2024-0447.html · Note
• https://crates.io/crates/pgp · Note