Описание
stellar-strkey vulnerable to panic in SignedPayload::from_payload
Impact
Panic vulnerability when a specially crafted payload is used. This is because of the following calculation:
If inner_payload_len is 0xffffffff, (4 - inner_payload_len % 4) % 4 = 1 so
which overflow.
Patches
Check that inner_payload_len is not above 64 which should never be the case.
Patched in version 0.0.8
Workarounds
Sanitize input payload before it is passed to the vulnerable function so that bytes in payload[32..32+4] and parsed as a u32 is not above 64.
References
GitHub issue #58
Ссылки
- https://github.com/stellar/rs-stellar-strkey/security/advisories/GHSA-5873-6fwq-463f
- https://nvd.nist.gov/vuln/detail/CVE-2023-46135
- https://github.com/stellar/rs-stellar-strkey/issues/58
- https://github.com/stellar/rs-stellar-strkey/pull/59
- https://github.com/stellar/rs-stellar-strkey/commit/83adad0f5b1cda693c7ba8524d395add8077865f
- https://github.com/stellar/rs-stellar-strkey/releases/tag/v0.0.8
Пакеты
stellar-strkey
< 0.0.8
0.0.8
Связанные уязвимости
rs-stellar-strkey is a Rust lib for encode/decode of Stellar Strkeys. A panic vulnerability occurs when a specially crafted payload is used.`inner_payload_len` should not above 64. This vulnerability has been patched in version 0.0.8.