Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

kanidmd_lib

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.9crates.ioPublished

    kanidmd_lib: Image upload validators run before authorization; PNG validator panics on malformed input

    GHSA-84jc-3hj2-hwc7

    Affected
    • crates.io kanidmd_lib < 1.9.3
    Fixed in
    1.9.3· Vendor fix available
    Issue
    The POST /v1/domain/image and POST /v1/oauth2/{rsname}/image handlers call validateimage() on the uploaded body before the ACL check that restricts image upload to admins. Any bug in an image validator is therefore reachable by an unauthenticated remote client rather than being admin-gated. One such bug exists today: pnghastrailer() panics on inputs shorter than 8 bytes, or whose first chunk-length field is near u32::MAX. On a default build this has no server-wide impact. The panic unwinds only the requester's own tokio task; the server process survives, no shared state is poisoned, and other connections are unaffected. This was reported privately rather than as a public issue because (a) the project previously treated an admin-triggered thread crash of identical impact as security-relevant (e51d0dee4), and this is reachable by a broader population; and (b) a downstream build with panic = "abort" would upgrade it to an unauthenticated process-crash DoS. Details…

    Recommended action: Upgrade to 1.9.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →