CVE-2023-39914

BER/CER/DER decoder panics on invalid input

State: Published
Severity: 7.5 High
Published: Sep 13, 2023
Updated: Sep 12, 2024
Reserved: Aug 7, 2023

Description

NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NLnet Labs

Weaknesses

CWE-232 Improper Handling of Undefined Values
CWE-240 Improper Handling of Inconsistent Structural Elements

Affected Products

Product	Versions
bcderNLnet Labs	before 0.7.3Affected 0.7.3 and laterNot affected

References

https://nlnetlabs.nl/downloads/bcder/CVE-2023-39914.txtvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.