CVE-2024-58261

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-58261
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-58261.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-58261
Aliases
Downstream
Published
2025-07-27T20:15:24Z
Modified
2025-07-29T14:49:52.229244Z
Summary
[none]
Details

The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messages for RawCertParser operations that encounter an unsupported primary key type.

References

Affected packages

Debian:13 / rust-sequoia-openpgp

Package

Name
rust-sequoia-openpgp
Purl
pkg:deb/debian/rust-sequoia-openpgp?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.21.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / gitlab.com/sequoia-pgp/sequoia

Affected ranges

Type
GIT
Repo
https://gitlab.com/sequoia-pgp/sequoia
Events
Introduced
42937aa54d10033a1c41509d7817f9eb1ca17845
Fixed
52ae37f884a0cd6c13d22963b93b09b2159e32fe

Affected versions

autocrypt/v0.*

autocrypt/v0.25.0
autocrypt/v0.25.1

buffered-reader/v1.*

buffered-reader/v1.2.0
buffered-reader/v1.3.0
buffered-reader/v1.3.1

ipc/v0.*

ipc/v0.30.0
ipc/v0.30.1
ipc/v0.31.0
ipc/v0.32.0
ipc/v0.33.0
ipc/v0.34.0
ipc/v0.34.1
ipc/v0.35.0

net/v0.*

net/v0.26.0
net/v0.27.0
net/v0.28.0

openpgp/v1.*

openpgp/v1.13.0
openpgp/v1.14.0
openpgp/v1.15.0
openpgp/v1.16.0
openpgp/v1.17.0
openpgp/v1.18.0
openpgp/v1.19.0
openpgp/v1.20.0

sq/v0.*

sq/v0.28.0