VDB
Sign up
HIGH8.6

GHSA-mjw4-jj88-v687

panic on parsing crafted phonenumber inputs

Details

### Impact The phonenumber parsing code may panic due to a reachable `assert!` guard on the phonenumber string.

In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the "number" part potentially parses as a number larger than 2^56.

Since f69abee1/0.3.4/#52.

0.2.x series is not affected.

### Patches Upgrade to 0.3.6 or higher.

### Workarounds n/a

### References Whereas https://github.com/whisperfish/rust-phonenumber/issues/69 did not provide an example code path, property testing found a few: `+dwPAA;phone-context=AA`.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/phonenumber
Introduced in: 0.3.4Fixed in: 0.3.6

Upgrade phonenumber to 0.3.6 or newer (ecosystem crates.io).

References