medium5.3
CVE-2023-46135
stellar-strkey vulnerable to panic in SignedPayload::from_payload
Impact
### Impact Panic vulnerability when a specially crafted payload is used. This is because of the following calculation: ```rust inner_payload_len + (4 - inner_payload_len % 4) % 4 ``` If `inner_payload_len` is `0xffffffff`, `(4 - inner_payload_len % 4) % 4 = 1` so ```rust inner_payload_len + (4 - inner_payload_len % 4) % 4 = u32::MAX + 1 ``` which overflow. ### Patches Check that `inner_payload_len` is not above 64 which should never be the case. Patched in version 0.0.8 ### Workarounds Sanitize input payload before it is passed to the vulnerable function so that bytes in `payload[32..32+4]` and parsed as a `u32` is not above 64. ### References GitHub issue #58
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | stellar-strkey | < 0.0.8 | 0.0.8 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Stellar | Rs-Stellar-Strkey | before 0.0.8 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/stellar/rs-stellar-strkey/issues/58
- https://github.com/stellar/rs-stellar-strkey/security/advisories/GHSA-5873-6fwq-463f
- https://github.com/advisories/GHSA-5873-6fwq-463f
- https://github.com/stellar/rs-stellar-strkey/pull/59
- https://github.com/stellar/rs-stellar-strkey/commit/83adad0f5b1cda693c7ba8524d395add8077865f
- https://github.com/stellar/rs-stellar-strkey/releases/tag/v0.0.8
- https://nvd.nist.gov/vuln/detail/CVE-2023-46135