CVE-2023-39914 BER/CER/DER decoder panics on invalid input
An attacker can cause a denial of service by providing invalid input to the bcder library, triggering a panic during decoding.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-39914?
CVE-2023-39914 is a high-severity denial of service vulnerability in NLnet Labs bcder, published on 13 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding.
Which versions are affected by CVE-2023-39914?
3 open source packages ship an affected version, including bcder. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
bcder crates.io | All versions | 0.7.3 |
bcder crates.io | All versions | 0.7.3 |
bcder crates.io | From 0.0.0-0 | 0.7.3 |
Products include Nlnetlabs Bcder.
How do I fix CVE-2023-39914?
Upgrade bcder to 0.7.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-39914 being exploited?
There is no known exploitation of CVE-2023-39914 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2023-39914, GHSA-6jmw-6mxw-w4jc, RUSTSEC-2023-0062.