CVE-2023-42444
19.09.2023, 15:15
phonenumber is a library for parsing, formatting and validating international phone numbers. Prior to versions `0.3.3+8.13.9` and `0.2.5+8.11.3`, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of `rust-phonenumber`, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string `.;phone-context=`. Versions `0.3.3+8.13.9` and `0.2.5+8.11.3` contain a patch for this issue. There are no known workarounds.Enginsight
| Vendor | Product | Version |
|---|---|---|
| whisperfish | phonenumber | 𝑥 < 0.2.5\+8.11.3 |
| whisperfish | phonenumber | 0.3.0\+8.12.9 ≤ 𝑥 < 0.3.3\+8.13.9 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-248 - Uncaught ExceptionAn exception is thrown from a function, but it is not caught.
- CWE-1284 - Improper Validation of Specified Quantity in InputThe product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
References