CVE-2023-39914

Published Sep 13, 2023

Last updated 3 months ago

Overview

Description: NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding.
Source: sep@nlnetlabs.nl
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

Weaknesses

sep@nlnetlabs.nl: CWE-232
nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:nlnetlabs:bcder:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "01667F69-EC35-4FDC-96BE-E633C2F494C4",
            "versionEndExcluding": "0.7.3"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References