high8.6
CVE-2023-42447
blurhash panics on parsing crafted inputs
Impact
### Impact The blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input. In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include: - UTF-8 compliant strings containing multi-byte UTF-8 characters ### Patches The patches will be released under version 0.2.0, which requires user intervention because of slight API churn. ### Workarounds n.a. ### References n.a.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | blurhash | = 0.1.1 | 0.2.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Whisperfish | Blurhash-Rs | Version 0.1.1 |