medium5.3
CVE-2023-53157
Remotely exploitable denial of service in Rosenpass
Impact
Affected versions of this crate did not validate the size of buffers when attempting to decode messages. This allows an attacker to trigger a panic by sending a UDP datagram with a 1 byte payload over network. This flaw was corrected by validating the size of the buffers before attempting to decode the message.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | rosenpass | < 0.2.1 | 0.2.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rosenpass | Rosenpass | before 0.2.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://crates.io/crates/rosenpass
- https://github.com/advisories/GHSA-6ggr-cwv4-g7qg
- https://github.com/rosenpass/rosenpass/commit/93439858d1c44294a7b377f775c4fc897a370bb2
- https://rustsec.org/advisories/RUSTSEC-2023-0077.html
- https://nvd.nist.gov/vuln/detail/CVE-2023-53157