RUSTSEC-2023-0052

See a problem?
Please try reporting it to the source first.
Source
https://rustsec.org/advisories/RUSTSEC-2023-0052
Import Source
https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2023-0052.json
JSON Data
https://api.osv.dev/v1/vulns/RUSTSEC-2023-0052
Aliases
Related
Published
2023-08-22T12:00:00Z
Modified
2023-11-01T05:06:47.556037Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
webpki: CPU denial of service in certificate path building
Details

When this crate is given a pathological certificate chain to validate, it will spend CPU time exponential with the number of candidate certificates at each step of path building.

Both TLS clients and TLS servers that accept client certificate are affected.

This was previously reported in https://github.com/briansmith/webpki/issues/69 and re-reported recently by Luke Malinowski.

webpki 0.22.1 included a partial fix and webpki 0.22.2 added further fixes.

References

Affected packages

crates.io / webpki

Package

Name
webpki
View open source insights on deps.dev
Purl
pkg:cargo/webpki

Affected ranges

Type
SEMVER
Events
Introduced
0.0.0-0
Fixed
0.22.2

Ecosystem specific 

{
    "affected_functions": null,
    "affects": {
        "os": [],
        "functions": [],
        "arch": []
    }
}

Database specific 

{
    "cvss": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
    "informational": null,
    "categories": [
        "denial-of-service"
    ]
}