GHSA-8qv2-5vq6-g2g7

Suggest an improvement
Source
https://github.com/advisories/GHSA-8qv2-5vq6-g2g7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-8qv2-5vq6-g2g7/GHSA-8qv2-5vq6-g2g7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-8qv2-5vq6-g2g7
Aliases
Published
2023-08-25T00:12:39Z
Modified
2023-11-08T04:17:28.966498Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
webpki: CPU denial of service in certificate path building
Details

When this crate is given a pathological certificate chain to validate, it will spend CPU time exponential with the number of candidate certificates at each step of path building.

Both TLS clients and TLS servers that accept client certificate are affected.

This was previously reported in https://github.com/briansmith/webpki/issues/69.

rustls-webpki is a fork of this crate which contains a fix for this issue and is actively maintained.

Database specific 
{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-400"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-25T00:12:39Z"
}
References

Affected packages

crates.io / webpki

Package

Name
webpki
View open source insights on deps.dev
Purl
pkg:cargo/webpki

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.22.2

Database specific 

{
    "last_known_affected_version_range": "<= 0.22.1"
}