—
RUSTSEC-2023-0038
Out-of-bounds array access leads to panic
Details
Affected versions of the crate have several bugs where attacker-controlled input can result in the use of an out-of-bound array index. Rust detects the use of the out-of-bound index and causes the application to panic. An attacker may be able to use this to cause a denial-of-service. However, it is not possible for an attacker to read from or write to the application's address space.
Are you affected?
Enter the version of the package you're using.
Affected packages
crates.io/sequoia-openpgp
Introduced in:
0.0.0-0Fixed in: 1.1.1Upgrade sequoia-openpgp to 1.1.1 or newer (ecosystem crates.io).
References
- https://crates.io/crates/sequoia-openpgp[PACKAGE]
- https://rustsec.org/advisories/RUSTSEC-2023-0038.html[ADVISORY]
- https://lists.sequoia-pgp.org/hyperkitty/list/announce@lists.sequoia-pgp.org/thread/SN2E3QRT4DMQ5JNEK6VIN6DJ5SH766DI/[WEB]
- https://gitlab.com/sequoia-pgp/sequoia/-/tags/openpgp%2Fv1.16.0[WEB]