Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

simple_asn1

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Unratedcrates.ioPublished

    Panic on incorrect date input to simple_asn1

    GHSA-3m6f-3gfg-4x56

    Affected
    • crates.io simple_asn1 >= 0.6.0, <= 0.6.0
    Fixed in
    0.6.1· Vendor fix available
    Issue
    Version 0.6.0 of the simpleasn1 crate panics on certain malformed inputs to its parsing functions, including fromder and derdecode. Because this crate is frequently used with inputs from the network, this should be considered a security vulnerability. The issue occurs when parsing the old ASN.1 "UTCTime" time format. If an attacker provides a UTCTime where the first character is ASCII but the second character is above 0x7f, a string slice operation in the fromder function will try to slice into the middle of a UTF-8 character, and cause a panic. This error was introduced in commit d7d39d709577710e9dc8, which updated simpleasn1 to use time instead of chrono because of RUSTSEC-2020-159. Versions of simpleasn1 before 0.6.0 are not affected by this issue. The patch was applied in simpleasn1 version 0.6.1.

    Recommended action: Upgrade to 0.6.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. High, CVSS 7.5crates.ioPublished

    Uncontrolled Resource Consumption in simple_asn1

    CVE-2021-45711 · GHSA-g4h2-4wvh-grc5

    Affected
    • crates.io simple_asn1 >= 0.6.0, <= 0.6.0
    Fixed in
    0.6.1· Vendor fix available
    Issue
    An issue was discovered in the simpleasn1 crate 0.6.0 before 0.6.1 for Rust. There is a panic if UTCTime data, supplied by a remote attacker, has a second character greater than 0x7f.

    Recommended action: Upgrade to 0.6.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →