CVE-2023-46135 Panic in SignedPayload::from_payload
A specially crafted payload causes a panic in the rs-stellar-strkey library, leading to a denial of service for applications using it.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-46135?
CVE-2023-46135 is a medium-severity denial of service vulnerability in rs-stellar-strkey, published on 25 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
rs-stellar-strkey is a Rust lib for encode/decode of Stellar Strkeys. A panic vulnerability occurs when a specially crafted payload is used.`inner_payload_len` should not above 64. This vulnerability has been patched in version 0.0.8.
Weakness: CWE-248
Which versions are affected by CVE-2023-46135?
2 open source packages ship an affected version, including stellar-strkey. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
stellar-strkey crates.io | All versions | 0.0.8 |
stellar-strkey crates.io | All versions | 0.0.8 |
Products include Stellar Rs-Stellar-Strkey.
How do I fix CVE-2023-46135?
Upgrade stellar-strkey to 0.0.8 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-46135 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-46135 exists.
Sources
Also known as GHSA-5873-6fwq-463f.