Reported

November 4, 2023

Issued

December 21, 2023 (last modified: February 10, 2024)

Package

rosenpass (crates.io)

Type

Vulnerability

Categories

• denial-of-service

Keywords

#remote #single-byte

Aliases

• GHSA-6ggr-cwv4-g7qg

References

• https://github.com/rosenpass/rosenpass/commit/93439858d1c44294a7b377f775c4fc897a370bb2

Patched

• >=0.2.1

Description

Affected version do this crate did not validate the size of buffers when attempting to decode messages.

This allows an attacker to trigger a panic by sending a UDP datagram with a 1 byte payload over network.

This flaw was corrected by validating the size of the buffers before attempting to decode the message.

Advisory available under CC0-1.0 license.