CVE-2017-1000430 Integer overflow in base64

Q: Which versions are affected by CVE-2017-1000430?

3 open source packages ship an affected version, including base64. It affects 1 product.

Q: Is CVE-2017-1000430 being exploited?

There is no known exploitation of CVE-2017-1000430 in the wild and no public exploit code.

Q: How do I fix CVE-2017-1000430?

Upgrade base64 to 0.5.2 or later.

Critical 9.8 Published 2 Jan 2018 Updated 17 Sep 2024

A buffer overflow in the Rust base64 library allows attackers to cause memory corruption, potentially leading to code execution or crashes.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2017-1000430?

CVE-2017-1000430 is a critical memory corruption vulnerability in n/a, published on 2 Jan 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

rust-base64 version <= 0.5.1 is vulnerable to a buffer overflow when calculating the size of a buffer to use when encoding base64 using the 'encode_config_buf' and 'encode_config' functions

Weakness: CWE-119

Which versions are affected by CVE-2017-1000430?

3 open source packages ship an affected version, including base64. It affects 1 product.

Package	Affected	Fixed in
`base64` crates.io	All versions	`0.5.2`
`base64` crates.io	All versions	`0.5.2`
`base64` crates.io	From `0.0.0-0`	`0.5.2`

Products include Rust-Base64 Project Rust-Base64.

How do I fix CVE-2017-1000430?

Upgrade base64 to 0.5.2 or later.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2017-1000430 being exploited?