GHSA-9344-p847-qm5c

Source

https://github.com/advisories/GHSA-9344-p847-qm5c

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-9344-p847-qm5c/GHSA-9344-p847-qm5c.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-9344-p847-qm5c

Aliases

CVE-2024-58261

Published

2024-06-26T19:10:15Z

Modified

2025-07-28T16:15:05.595162Z

Severity

2.9 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

Low severity (DoS) vulnerability in sequoia-openpgp

Details

There is a denial-of-service vulnerability in sequoia-openpgp, our crate providing a low-level interface to our OpenPGP implementation. When triggered, the process will enter an infinite loop.

Many thanks to Andrew Gallagher for disclosing the issue to us.

Impact

Any software directly or indirectly using the interface sequoia_openpgp::cert::raw::RawCertParser. Notably, this includes all software using the sequoia_cert_store crate.

Details

The RawCertParser does not advance the input stream when encountering unsupported cert (primary key) versions, resulting in an infinite loop.

The fix introduces a new raw-cert-specific cert::raw::Error::UnuspportedCert.

Affected software

sequoia-openpgp 1.13.0
sequoia-openpgp 1.14.0
sequoia-openpgp 1.15.0
sequoia-openpgp 1.16.0
sequoia-openpgp 1.17.0
sequoia-openpgp 1.18.0
sequoia-openpgp 1.19.0
sequoia-openpgp 1.20.0
Any software built against a vulnerable version of sequoia-openpgp which is directly or indirectly using the interface sequoia_openpgp::cert::raw::RawCertParser. Notably, this includes all software using the sequoia_cert_store crate.

Database specific

{
    "github_reviewed_at": "2024-06-26T19:10:15Z",
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-835"
    ],
    "github_reviewed": true,
    "severity": "LOW"
}

References

Affected packages

crates.io / sequoia-openpgp

Package

Name: sequoia-openpgp; View open source insights on deps.dev
Purl: pkg:cargo/sequoia-openpgp

Affected ranges

Type: SEMVER
Events: Introduced

1.13.0

Fixed

1.21.0