CVE-2023-39914
Assigner: NLnet Labs
Published: 2023-09-13T14:17:49.204Z
State: PUBLISHED
title: BER/CER/DER decoder panics on invalid input
datePublic: 2023-09-13T00:00:00.000Z
affected: vendor: NLnet Labs
product: bcder
versions: version: *
status: affected
lessThan: 0.7.3
versionType: semver
version: 0.7.3
status: unaffected
lessThan: *
versionType: semver
defaultStatus: unaffected
descriptions: value: NLnet Labs’ bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding.
metrics: format: CVSS
scenarios: value: GENERAL
cvssV3_1: version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
problemTypes: descriptions: cweId: CWE-228
description: CWE-228: Improper Handling of Syntactically Invalid Structure
type: CWE
solutions: value: This issue is fixed in 0.7.3 and all later versions.
timeline: time: 2023-07-19T18:00:00.000Z
value: Issue reported by Haya Shulman
time: 2023-09-13T14:00:00.000Z
value: Fixes released
credits: value: Haya Shulman
type: finder
value: Donika Mirdita
type: finder
value: Niklas Vogel
type: finder