cortex / ripasso

A simple password manager written in Rust
GNU General Public License v3.0
721 stars 64 forks source link

RUSTSEC-2023-0039: Out-of-bounds array access leads to panic #316

Closed github-actions[bot] closed 1 year ago

github-actions[bot] commented 1 year ago
Details
Package buffered-reader
Version 1.1.4
URL https://lists.sequoia-pgp.org/hyperkitty/list/announce@lists.sequoia-pgp.org/thread/SN2E3QRT4DMQ5JNEK6VIN6DJ5SH766DI/
Patched Versions >=1.0.2, <1.1.0 OR >=1.1.5, <1.2.0 OR >=1.2.0
Aliases GHSA-29mf-62xx-28jq

Affected versions of the crate have a bug where attacker-controlled input can result in the use of an out-of-bound array index. Rust detects the use of the out-of-bound index and causes the application to panic. An attacker may be able to use this to cause a denial-of-service. However, it is not possible for an attacker to read from or write to the application's address space.