Remotely exploitable denial of service in Rosenpass
High severity
GitHub Reviewed
Published
Dec 21, 2023
to the GitHub Advisory Database
•
Updated Dec 21, 2023
Description
Published to the GitHub Advisory Database
Dec 21, 2023
Reviewed
Dec 21, 2023
Last updated
Dec 21, 2023
Affected versions of this crate did not validate the size of buffers when attempting to decode messages.
This allows an attacker to trigger a panic by sending a UDP datagram with a 1 byte payload over network.
This flaw was corrected by validating the size of the buffers before attempting to decode the message.
References