CVE-2024-53857

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2024-53857

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-53857.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2024-53857

Aliases

GHSA-4grw-m28r-q285

Published

2024-12-05T16:15:26Z

Modified

2025-01-08T09:56:00.419153Z

Summary

[none]

Details

rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows attackers to trigger resource exhaustion vulnerabilities in rpgp by providing crafted messages. This affects general message parsing and decryption with symmetric keys.

References

Affected packages

Debian:13 / rust-pgp

Package

Name: rust-pgp
Purl: pkg:deb/debian/rust-pgp?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.14.2-1

Affected versions

0.*

0.13.2-1

0.13.2-2

0.13.2-3

0.14.0-1

0.14.0-2

0.14.0-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}