CVE-2019-15549 Memory exhaustion in asn1_der
Attackers can cause memory exhaustion and denial of service by supplying large length values to the asn1_der Rust library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-15549?
CVE-2019-15549 is a high-severity denial of service vulnerability in n/a, published on 26 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the asn1_der crate before 0.6.2 for Rust. Attackers can trigger memory exhaustion by supplying a large value in a length field.
Weakness: CWE-400
Which versions are affected by CVE-2019-15549?
3 open source packages ship an affected version, including asn1_der. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
asn1_der crates.io | All versions | 0.6.2 |
asn1_der crates.io | All versions | 0.6.2 |
asn1_der crates.io | From 0.0.0-0 | 0.6.2 |
Products include Asn1 Der Project Asn1 Der.
How do I fix CVE-2019-15549?
Upgrade asn1_der to 0.6.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-15549 being exploited?
There is no known exploitation of CVE-2019-15549 in the wild and no public exploit code.
Sources
Also known as GHSA-v5r6-6r3c-wqxc, RUSTSEC-2019-0007.