sequoia-openpgp vulnerable to out-of-bounds array access leading to panic
Low severity
GitHub Reviewed
Published
Jun 6, 2023
to the GitHub Advisory Database
•
Updated Jun 6, 2023
Package
Affected versions
< 1.1.1
>= 1.2.0, < 1.8.1
>= 1.9.0, < 1.16.0
Patched versions
1.1.1
1.8.1
1.16.0
Description
Published to the GitHub Advisory Database
Jun 6, 2023
Reviewed
Jun 6, 2023
Last updated
Jun 6, 2023
Affected versions of the crate have several bugs where attacker-controlled input can result in the use of an out-of-bound array index. Rust detects the use of the out-of-bound index and causes the application to panic. An attacker may be able to use this to cause a denial-of-service. However, it is not possible for an attacker to read from or write to the application's address space.
References