RUSTSEC-2020-0068

See a problem?
Source
https://rustsec.org/advisories/RUSTSEC-2020-0068
Import Source
https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2020-0068.json
JSON Data
https://api.osv.dev/v1/vulns/RUSTSEC-2020-0068
Aliases
Published
2020-11-08T12:00:00Z
Modified
2023-11-08T04:03:38.796770Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Unexpected panic in multihash `from_slice` parsing code
Details

In versions prior 0.11.3 it's possible to make from_slice panic by feeding it certain malformed input. It's never documented that from_slice (and from_bytes which wraps it) can panic, and its' return type (Result<Self, DecodeError>) suggests otherwise.

In practice, from_slice/from_bytes is frequently used in networking code (for example in rust-libp2p) and is being called with unsanitized data from untrusted sources. This can allow attackers to cause DoS by causing an unexpected panic in the network client's code.

References

Affected packages

crates.io / multihash

Package

Affected ranges

Type
SEMVER
Events
Introduced
0.0.0-0
Fixed
0.11.3

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "os": [],
        "functions": [
            "multihash::digests::MultihashGeneric::from_bytes",
            "multihash::digests::MultihashRefGeneric::from_slice"
        ],
        "arch": []
    }
}

Database specific

{
    "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
    "informational": null,
    "categories": [
        "denial-of-service"
    ]
}