GHSA-8qv2-5vq6-g2g7

Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-8qv2-5vq6-g2g7/GHSA-8qv2-5vq6-g2g7.json
Aliases
Published
2023-08-25T00:12:39Z
Modified
2023-09-06T17:36:28Z
Details

When this crate is given a pathological certificate chain to validate, it will spend CPU time exponential with the number of candidate certificates at each step of path building.

Both TLS clients and TLS servers that accept client certificate are affected.

This was previously reported in https://github.com/briansmith/webpki/issues/69.

rustls-webpki is a fork of this crate which contains a fix for this issue and is actively maintained.

References

Affected packages

crates.io / webpki

Source Details

Package Name
webpki

Affected ranges

Type
SEMVER
Events
Introduced
0The exact introduced commit is unknown
Fixed
0.22.1

Ecosystem specific 

{
    "affected_functions": [
        ""
    ]
}

Database specific 

{
    "last_known_affected_version_range": "<= 0.22.0"
}