diff --git a/crates/asn1_der/RUSTSEC-0000-0000.toml b/crates/asn1_der/RUSTSEC-0000-0000.toml new file mode 100644 index 0000000..7585508 --- /dev/null +++ b/crates/asn1_der/RUSTSEC-0000-0000.toml @@ -0,0 +1,22 @@ +[advisory] +id = "RUSTSEC-0000-0000" + +package = "asn1_der" + +date = "2019-06-13" + +title = "Processing of maliciously crafted length fields causes memory allocation SIGABRTs" + +description = """ +Affected versions of this crate tried to preallocate a vector for an arbitrary amount of bytes announced by the ASN.1-DER length field without further checks. + +This allows an attacker to trigger a SIGABRT by creating length fields that announce more bytes than the allocator can provide. + +The flaw was corrected by not preallocating memory. +""" + +patched_versions = [">= 0.6.2"] + +url = "https://github.com/KizzyCode/asn1_der/issues/1" + +keywords = ["dos"]