high7.5
CVE-2024-44073
Miniscript allows stack consumption
Impact
The Miniscript (aka rust-miniscript) library for Rust allows stack consumption because it does not properly track tree depth.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | miniscript | >= 12.0.0, < 12.2.0 | 12.2.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rust-Bitcoin | Miniscript | before 12.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/rust-bitcoin/rust-miniscript/compare/11.2.0...12.2.0
- https://github.com/rust-bitcoin/rust-miniscript/pull/704
- https://github.com/rust-bitcoin/rust-miniscript/pull/712
- https://github.com/advisories/GHSA-rv9v-r4vm-gj8x
- https://nvd.nist.gov/vuln/detail/CVE-2024-44073
- https://github.com/rust-bitcoin/rust-miniscript/commit/5b0f5e3417f027a22b066debf825dbe6644b575b
- https://github.com/rust-bitcoin/rust-miniscript/commit/8f54b5e3fb7129ed9fbed53f1cb9e6e62ea4c151
- https://github.com/rust-bitcoin/rust-miniscript/pull/712/files
- https://github.com/rust-bitcoin/rust-miniscript/pull/713/files
- https://github.com/rust-bitcoin/rust-miniscript/pull/714/files
- https://github.com/rust-bitcoin/rust-miniscript/pull/715/files