From 19e7661dae34b77e395b3d7aed3e75ae9df01536 Mon Sep 17 00:00:00 2001 From: Johannes Date: Sun, 29 Nov 2020 15:51:25 +0100 Subject: [PATCH] Add advisory for branca (#497) --- crates/branca/RUSTSEC-0000-0000.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 crates/branca/RUSTSEC-0000-0000.md diff --git a/crates/branca/RUSTSEC-0000-0000.md b/crates/branca/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..5eb0416 --- /dev/null +++ b/crates/branca/RUSTSEC-0000-0000.md @@ -0,0 +1,23 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "branca" +date = "2020-11-29" +url = "https://github.com/return/branca/issues/24" +categories = ["denial-of-service"] +keywords = ["decoding", "panic", "untrusted data"] + +[affected.functions] +"branca::decode" = ["< 0.10.0"] +"branca::Branca::decode" = ["< 0.10.0"] + +[versions] +patched = [">= 0.10.0"] +``` + +# Unexpected panic when decoding tokens + +Prior to `0.10.0` it was possible to have both decoding functions panic unexpectedly, +by supplying tokens with an incorrect base62 encoding. + +The documentation stated that an error should have been reported instead. \ No newline at end of file