PT-2025-10558 · Ring+1 · Ring+1

Published 2025-03-08 · Updated 2025-03-08

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions qcp versions 0.1.0 through 0.3.2

Description The issue is a crash, or Denial of Service, caused by a dependent package called ring. This crash can be induced by a specially-crafted packet and happens naturally approximately every 1 in 2**32 packets sent and/or received. The crash only occurs when runtime overflow checking is enabled. During qcp file transfer sessions, an attacker can send a specially-crafted packet to trigger this issue, resulting in a Rust panic that immediately aborts the transfer. The impact is limited to a single session, as qcp runs a separate process for every connected user. The qcp protocol itself does not rely on runtime overflow checks for its security.

Recommendations Upgrade to qcp 0.3.3 or later. Alternatively, rebuild qcp locally with runtime overflow checks disabled. Rebuild qcp locally using a fixed version of the ring dependency (0.17.12 or later).

Fix

Related Identifiers

GHSA-FMWF-C46W-R8QM

Affected Products

Qcp

Ring

References · 6

• https://osv.dev/vulnerability/GHSA-fmwf-c46w-r8qm · Vendor Advisory
• https://github.com/briansmith/ring/blob/main/RELEASES.md#version-01712-2025-03-05 · Note
• https://github.com/crazyscot/qcp · Note
• https://github.com/crazyscot/qcp/security/advisories/GHSA-fmwf-c46w-r8qm · Note
• https://rustsec.org/advisories/RUSTSEC-2025-0009.html · Note
• https://github.com/advisories/GHSA-4p46-pwfr-66x6 · Note