CVE-2019-25001 Out of bounds write in serde_cbor
Attackers can cause a denial of service via stack consumption in the serde_cbor crate by sending nested semantic tags.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-25001?
CVE-2019-25001 is a high-severity denial of service vulnerability in n/a, published on 31 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the serde_cbor crate before 0.10.2 for Rust. The CBOR deserializer can cause stack consumption via nested semantic tags.
Weakness: CWE-787
Which versions are affected by CVE-2019-25001?
3 open source packages ship an affected version, including serde_cbor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
serde_cbor crates.io | All versions | 0.10.2 |
serde_cbor crates.io | All versions | 0.10.2 |
serde_cbor crates.io | From 0.0.0-0 | 0.10.2 |
Products include Serde Cbor Project Serde Cbor.
How do I fix CVE-2019-25001?
Upgrade serde_cbor to 0.10.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-25001 being exploited?
There is no known exploitation of CVE-2019-25001 in the wild and no public exploit code.
Sources
Also known as GHSA-xr7r-88qv-q7hm, RUSTSEC-2019-0025, UBUNTU-CVE-2019-25001.