CVE-2023-53160

The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
2.9 LOW
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
mitreCNA
2.9 LOW
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 12%
VendorProductVersion
sequoia-pgpsequoia-openpgp
𝑥
< 1.1.1
sequoia-pgpsequoia-openpgp
1.2.0 ≤
𝑥
< 1.8.1
sequoia-pgpsequoia-openpgp
1.9.0 ≤
𝑥
< 1.16.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
rust-sequoia-openpgp
plucky
needs-triage
noble
needs-triage
jammy
needs-triage
rust-sequoia-openpgp-mt
plucky
needs-triage
noble
needs-triage
jammy
dne
Common Weakness Enumeration
References
https://crates.io/crates/sequoia-openpgp
https://github.com/advisories/GHSA-25mx-8f3v-8wh7
https://lists.sequoia-pgp.org/hyperkitty/list/announce@lists.sequoia-pgp.org/thread/SN2E3QRT4DMQ5JNEK6VIN6DJ5SH766DI/
https://rustsec.org/advisories/RUSTSEC-2023-0038.html