GHSA-x67x-vg9m-65c3
Suggest an improvement- Source
- https://github.com/advisories/GHSA-x67x-vg9m-65c3
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-x67x-vg9m-65c3/GHSA-x67x-vg9m-65c3.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-x67x-vg9m-65c3
- Aliases
- Published
- 2021-08-25T20:55:27Z
- Modified
- 2023-11-08T03:58:46.425555Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Integer overflow in base64
- Details
-
Affected versions of this crate suffered from an integer overflow bug when calculating the size of a buffer to use when encoding base64 using the
encode_config_bufandencode_configfunctions. If the input string was large, this would cause a buffer to be allocated that was too small. Since this function writes to the buffer using unsafe code, it would allow an attacker to write beyond the buffer, causing memory corruption and possibly the execution of arbitrary code.This flaw was corrected by using checked arithmetic to calculate the size of the buffer.
- Database specific
{ "nvd_published_at": null, "github_reviewed_at": "2021-08-19T17:02:46Z", "severity": "CRITICAL", "github_reviewed": true, "cwe_ids": [ "CWE-119" ] }- References
Affected packages
crates.io / base64
Package
- Name
- base64
- View open source insights on deps.dev
- Purl
- pkg:cargo/base64