CVE-2024-53856 — Improper Handling of Length Parameter Inconsistency in Rpgp

CWE-130 — Improper Handling of Length Parameter InconsistencyCWE-148 — Improper Neutralization of Input LeadersCWE-617 — Reachable AssertionCWE-248 — Uncaught Exception6 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.2%
top 56.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
RpgpPGPDebian Rust-pgp
Timeline
PublishedDec 5

Description

rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows an attacker to trigger rpgp crashes by providing crafted data. This vulnerability is fixed in 0.14.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5rpgp/rpgp< 0.14.1
▶debiandebian/rust-pgp< rust-pgp 0.14.2-1 (forky)
▶crates.iopgp/pgp0.0.0-0 — 0.14.1+1

🔴Vulnerability Details

4
OSV
CVE-2024-53856: rPGP is a pure Rust implementation of OpenPGP↗2024-12-05
▶
GHSA
rPGP Panics on Malformed Untrusted Input↗2024-12-05
▶
OSV
rPGP Panics on Malformed Untrusted Input↗2024-12-05
▶
OSV
Panics on Malformed Untrusted Input↗2024-12-05
▶

📋Vendor Advisories

1
Debian
CVE-2024-53856: rust-pgp - rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows an a...↗2024
▶