From 9b0fad7608a9e018c4a5803e28b6879bc9641017 Mon Sep 17 00:00:00 2001 From: Ruben De Smet Date: Sat, 2 Mar 2024 18:21:59 +0100 Subject: [PATCH] blurhash-rs panic-on-parse (#1786) * blurhash-rs panic-on-parse * Patches for blurhash-rs were released --- crates/blurhash/RUSTSEC-0000-0000.md | 30 ++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 crates/blurhash/RUSTSEC-0000-0000.md diff --git a/crates/blurhash/RUSTSEC-0000-0000.md b/crates/blurhash/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..0392f4a --- /dev/null +++ b/crates/blurhash/RUSTSEC-0000-0000.md @@ -0,0 +1,30 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" + +package = "blurhash" +date = "2023-09-19" +url = "https://github.com/whisperfish/blurhash-rs/security/advisories/GHSA-cxvp-82cq-57h2" +references = ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42447"] +categories = ["denial-of-service"] +cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H" +keywords = ["panic", "untrusted input", "parsing"] +aliases = ["CVE-2023-42447", "cxvp-82cq-57h2"] + +[affected] +functions = { "blurhash::decode" = ["*"] } + +[versions] +patched = [">= 0.2.0"] +``` + +# blurhash: panic on parsing crafted blurhash inputs + +## Impact +The blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input. + +In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include: +- UTF-8 compliant strings containing multi-byte UTF-8 characters + +## Patches +The patches were released under version 0.2.0, which may require user intervention because of slight API churn.