Denial of Service Vulnerability in libcrypto++: Application Crash via DER Public-Key Data
Summary
DEBIAN-CVE-2023-50980: gf2n.cpp in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of service (application crash) via DER public-key data for an F(2^m) curve, if the degree of each term in the polynomial is not strictl... Affects libcrypto++ versions < 8.9.0-2. Fixed in 8.9.0-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libcrypto++ is a widely used C++ library that provides cryptographic algorithms and schemes. It is utilized in various applications for secure data transmission and encryption. The library supports multiple cryptographic protocols and is known for its performance and flexibility. However, it has been found to be vulnerable to a specific issue that can lead to application crashes when handling certain public-key data formats.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2023-50980 exists in the gf2n.cpp file of the Crypto++ library, specifically in versions up to 8.9.0. It allows attackers to exploit the library by providing DER public-key data for an F(2^m) curve, where the degree of each term in the polynomial is not strictly decreasing. This can lead to a denial of service, causing the application to crash unexpectedly. The issue arises from improper handling of the polynomial data, which can be manipulated to trigger the crash.
How To Fix
Minimum fixed version
8.9.0-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libcrypto++Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to update the package to the fixed version as mentioned above.
Conclusion
The vulnerability DEBIAN-CVE-2023-50980 in libcrypto++ poses a significant risk of denial of service through improper handling of public-key data. Users are strongly advised to update to the patched version to mitigate this risk. Regular monitoring of vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for libcrypto++ →
FAQ
The vulnerability allows for a denial of service attack, causing applications using the library to crash when processing certain malformed public-key data.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your manifest file like package-lock.json, you can determine if your application is impacted.
The vulnerability affects all versions of libcrypto++ up to and including 8.9.0. Users should upgrade to version 8.9.0-2 or later.
The most effective prevention method is to update to the patched version of libcrypto++. There are currently no known workarounds.
Detailed information can be found in the official Debian CVE database at the provided source link.
References
Related vulnerabilities
Recent vulnerabilities recorded for libcrypto++.
