CVE-2023-28448 Versionize is lacking bound checks, potentially leading to out of bounds memory access

🗓️ 24 Mar 2023 19:34:29Reported by GoogleType

osv🔗 osv.dev👁 13 Views

Issue in 'Versionize' crate for deserialization can cause out of bounds memory access, impact from 0.1.1 to 0.1.10. Corrected in 0.1.10 with length verification check

Reporter	Title	Published	Views	Family All 18
CBLMariner	CVE-2023-28448 affecting package cloud-hypervisor for versions less than 30.0-2	16 Apr 202302:55	–	cbl_mariner
CBLMariner	CVE-2023-28448 affecting package cloud-hypervisor 22.0-1	20 Apr 202319:14	–	cbl_mariner
Circl	CVE-2023-28448	24 Mar 202323:42	–	circl
CNNVD	Versionize 缓冲区错误漏洞	24 Mar 202300:00	–	cnnvd
CVE	CVE-2023-28448	24 Mar 202319:34	–	cve
Cvelist	CVE-2023-28448 Versionize is lacking bound checks, potentially leading to out of bounds memory access	24 Mar 202319:34	–	cvelist
EUVD	EUVD-2023-0952	3 Oct 202520:07	–	euvd
Github Security Blog	Versionize::deserialize implementation for FamStructWrapper<T> is lacking bound checks, potentially leading to out of bounds memory accesses	24 Mar 202322:00	–	github
Tenable Nessus	CBL Mariner 2.0 Security Update: cloud-hypervisor (CVE-2023-28448)	20 Apr 202300:00	–	nessus
Microsoft CVE	Versionize is lacking bound checks potentially leading to out of bounds memory access	3 Apr 202307:00	–	mscve

Source	Link
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28448.json
github	www.github.com/firecracker-microvm/versionize/security/advisories/GHSA-8vxc-r5wp-vgvc
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-28448
github	www.github.com/firecracker-microvm/versionize/commit/a57a051ba006cfa3b41a0532f484df759e008d47
github	www.github.com/firecracker-microvm/versionize/pull/53

02 Apr 2026 08:48Current

7.4High risk

Vulners AI Score7.4

CVSS 3.15.7

EPSS0.00284