Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2023-39914

BER/CER/DER decoder panics on invalid input

Description

NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

NLnet Labs bcder

Default version status: unaffected

  • * to < 0.7.3affected
  • 0.7.3 to < *unaffected

References