Lucene search

K
osvGoogleOSV:GHSA-3M6F-3GFG-4X56
HistoryJun 17, 2022 - 12:19 a.m.

Panic on incorrect date input to `simple_asn1`

2022-06-1700:19:49
Google
osv.dev
10
security vulnerability
simple_asn1
network inputs
utctime format
utf-8
time
commit
rustsec-2020-0159
patch

EPSS

0.002

Percentile

58.1%

Version 0.6.0 of the simple_asn1 crate panics on certain malformed
inputs to its parsing functions, including from_der and der_decode.
Because this crate is frequently used with inputs from the network, this
should be considered a security vulnerability.

The issue occurs when parsing the old ASN.1 “UTCTime” time format. If an
attacker provides a UTCTime where the first character is ASCII but the
second character is above 0x7f, a string slice operation in the
from_der_ function will try to slice into the middle of a UTF-8
character, and cause a panic.

This error was introduced in commit
d7d39d709577710e9dc8,
which updated simple_asn1 to use time instead of chrono because of
RUSTSEC-2020-159.
Versions of simple_asn1 before 0.6.0 are not affected by this issue.

The patch was applied in
simple_asn1 version 0.6.1.

EPSS

0.002

Percentile

58.1%

Related for OSV:GHSA-3M6F-3GFG-4X56