Resource Exhaustion Vulnerability in rust-pgp Package
Summary
DEBIAN-CVE-2024-53857: rPGP is a pure Rust implementation of OpenPGP. Affects rust-pgp versions < 0.14.2-1. Fixed in 0.14.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rust-pgp is a pure Rust implementation of OpenPGP, designed to provide cryptographic functionalities for secure message exchange. It supports various features of the OpenPGP standard, including encryption and decryption of messages using symmetric keys. However, prior to version 0.14.1, rust-pgp is susceptible to resource exhaustion vulnerabilities, which can be exploited through crafted messages.
Vulnerability Detail
The vulnerability in rust-pgp arises from its message parsing and decryption processes. Attackers can exploit this flaw by sending specially crafted messages that cause the application to consume excessive resources, leading to potential denial of service. This issue is particularly concerning as it affects the core functionalities of the package, making it a critical vulnerability for applications relying on rust-pgp for secure communications.
How To Fix
Minimum fixed version
0.14.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade rust-pgpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid processing untrusted or crafted messages until the package is updated. Implementing input validation and sanitization can also help mitigate the risk of exploitation.
Conclusion
The rust-pgp package has a critical vulnerability that can be exploited through crafted messages, leading to resource exhaustion. It is crucial to update to the latest patched version to ensure the security of applications relying on this library. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for rust-pgp →
FAQ
rust-pgp is a Rust library that implements the OpenPGP standard for secure message encryption and decryption.
It allows attackers to send specially crafted messages that can exhaust system resources, potentially leading to denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update rust-pgp to version 0.14.2-1 or later to mitigate the vulnerability. Additionally, consider implementing input validation.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for rust-pgp.
