CVE-2023-39914

NameCVE-2023-39914
DescriptionNLnet Labs’ bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1052176

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
rust-bcder (PTS)bookworm, sid, trixie0.6.1-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
rust-bcdersource(unstable)(unfixed)1052176

Notes

https://rustsec.org/advisories/RUSTSEC-2023-0062.html
https://nlnetlabs.nl/downloads/bcder/CVE-2023-39914.txt
https://github.com/NLnetLabs/bcder/pull/74
Search for package or bug name: Reporting problems