HIGH7.5
GHSA-xr7r-88qv-q7hm
Out of bounds write in serde_cbor
Details
Affected versions of this crate did not properly check if semantic tags were nested excessively during deserialization. This allows an attacker to craft small (< 1 kB) CBOR documents that cause a stack overflow. The flaw was corrected by limiting the allowed number of nested tags.
Are you affected?
Enter the version of the package you're using.
Affected packages
crates.io/serde_cbor
Introduced in:
0Fixed in: 0.10.2Upgrade serde_cbor to 0.10.2 or newer (ecosystem crates.io).
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-25001[ADVISORY]
- https://github.com/pyfisch/cbor/pull/153[WEB]
- https://github.com/pyfisch/cbor/commit/1aec4f9d71855dbfb223fa61ca60260400cc5d5f[WEB]
- https://github.com/pyfisch/cbor[PACKAGE]
- https://github.com/pyfisch/cbor/releases/tag/v0.10.2[WEB]
- https://rustsec.org/advisories/RUSTSEC-2019-0025.html[WEB]