Vulnerability-Lookup

CVE-2024-53857 (GCVE-0-2024-53857)

Vulnerability from cvelistv5 – Published: 2024-12-05 15:22 – Updated: 2024-12-05 16:34

Title

rPGP Potential Resource Exhaustion when handling Untrusted Messages

Summary

rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows attackers to trigger resource exhaustion vulnerabilities in rpgp by providing crafted messages. This affects general message parsing and decryption with symmetric keys.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M

References

URL

Tags

https://github.com/rpgp/rpgp/security/advisories/…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	rpgp	rpgp	Affected: < 0.14.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:rpgp:rpgp:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "rpgp",
            "vendor": "rpgp",
            "versions": [
              {
                "lessThan": "0.14.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-53857",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-05T16:32:52.619501Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-05T16:34:13.917Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rpgp",
          "vendor": "rpgp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.14.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows attackers to trigger resource exhaustion vulnerabilities in rpgp by providing crafted messages. This affects general message parsing and decryption with symmetric keys."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-05T15:22:09.049Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rpgp/rpgp/security/advisories/GHSA-4grw-m28r-q285",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rpgp/rpgp/security/advisories/GHSA-4grw-m28r-q285"
        }
      ],
      "source": {
        "advisory": "GHSA-4grw-m28r-q285",
        "discovery": "UNKNOWN"
      },
      "title": "rPGP Potential Resource Exhaustion when handling Untrusted Messages"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-53857",
    "datePublished": "2024-12-05T15:22:09.049Z",
    "dateReserved": "2024-11-22T17:30:02.142Z",
    "dateUpdated": "2024-12-05T16:34:13.917Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-53857\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-12-05T16:15:26.393\",\"lastModified\":\"2024-12-05T16:15:26.393\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows attackers to trigger resource exhaustion vulnerabilities in rpgp by providing crafted messages. This affects general message parsing and decryption with symmetric keys.\"},{\"lang\":\"es\",\"value\":\"rPGP es una implementaci\u00f3n pura de OpenPGP en Rust. Antes de la versi\u00f3n 0.14.1, rPGP permite a los atacantes activar vulnerabilidades de agotamiento de recursos en rpgp al proporcionar mensajes manipulados. Esto afecta el an\u00e1lisis y descifrado general de mensajes con claves sim\u00e9tricas.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"references\":[{\"url\":\"https://github.com/rpgp/rpgp/security/advisories/GHSA-4grw-m28r-q285\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-53857\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-12-05T16:32:52.619501Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:rpgp:rpgp:*:*:*:*:*:*:*:*\"], \"vendor\": \"rpgp\", \"product\": \"rpgp\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"0.14.1\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-12-05T16:34:05.683Z\"}}], \"cna\": {\"title\": \"rPGP Potential Resource Exhaustion when handling Untrusted Messages\", \"source\": {\"advisory\": \"GHSA-4grw-m28r-q285\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"rpgp\", \"product\": \"rpgp\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.14.1\"}]}], \"references\": [{\"url\": \"https://github.com/rpgp/rpgp/security/advisories/GHSA-4grw-m28r-q285\", \"name\": \"https://github.com/rpgp/rpgp/security/advisories/GHSA-4grw-m28r-q285\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows attackers to trigger resource exhaustion vulnerabilities in rpgp by providing crafted messages. This affects general message parsing and decryption with symmetric keys.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770: Allocation of Resources Without Limits or Throttling\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-12-05T15:22:09.049Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-53857\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-05T16:34:13.917Z\", \"dateReserved\": \"2024-11-22T17:30:02.142Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-12-05T15:22:09.049Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-4GRW-M28R-Q285

Vulnerability from github – Published: 2024-12-05 17:31 – Updated: 2024-12-05 19:05

Summary

rPGP Potential Resource Exhaustion when handling Untrusted Messages

Details

During a security audit, Radically Open Security discovered two vulnerabilities which allow attackers to trigger resource exhaustion vulnerabilities in rpgp by providing crafted messages. This affects general message parsing and decryption with symmetric keys.

Impact

Affected rpgp versions do not correctly set upper limits on the total reserved amount of memory when parsing long sequences of partial OpenPGP packets, which can grow to to several GiB in size. Additionally, up to 4GiB of memory is reserved for OpenPGP packets of fixed size with large length fields, even if less data is received. Depending on existing message size restrictions and available system resources, this can cause out-of-memory conditions and crash the rpgp process or cause other system instability through memory resource exhaustion when parsing crafted messages.

Affected rpgp versions are susceptible to excessive memory allocation with values of up to 2TiB or long processing times for some decryption operations which involve the Argon2 function. An attacker can provide a valid Symmetric Key Encrypted Session Key packet (SKESK) which uses Argon2 for String-to-Key hashing with parameters that are excessive, but within specification limits of the RFC9580 OpenPGP standard. Since rpgp did not further restrict the Argon2 parameters, this can cause out-of-memory conditions and crash the rpgp process. Under some conditions, the memory resource exhaustion may trigger other system instability. Alternatively, this can make the program unresponsive via long computations. The attacker needs to trick a victim into attempting decryption, but does not require knowledge of the symmetric secret used by the victim.

There is no impact to confidentiality or integrity security properties.

Versions and Patches

The impact details on the message parsing component varies with different versions. We've confirmed some of the problematic behavior on older versions such as v0.10.0 and see all recent versions as affected in some form.

The affected Argon2 functionality was introduced with v0.12.0-alpha.1, earlier versions are not vulnerable.

The vulnerabilities have been fixed with version 0.14.2. We recommend all users to upgrade to this version.

References

The security audit was made possible by the NLnet Foundation NGI Zero Core grant program for rpgp.

Severity ?

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "pgp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.14.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-53857"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-05T17:31:35Z",
    "nvd_published_at": "2024-12-05T16:15:26Z",
    "severity": "HIGH"
  },
  "details": "During a security audit, [Radically Open Security](https://www.radicallyopensecurity.com/) discovered two vulnerabilities which allow attackers to trigger resource exhaustion vulnerabilities in `rpgp` by providing crafted messages. This affects general message parsing and decryption with symmetric keys.\n\n### Impact\nAffected `rpgp` versions do not correctly set upper limits on the total reserved amount of memory when parsing long sequences of partial OpenPGP packets, which can grow to to several GiB in size. Additionally, up to 4GiB of memory is reserved for OpenPGP packets of fixed size with large length fields, even if less data is received. \nDepending on existing message size restrictions and available system resources, this can cause out-of-memory conditions and crash the `rpgp` process or cause other system instability through memory resource exhaustion when parsing crafted messages.\n\nAffected `rpgp` versions are susceptible to excessive memory allocation with values of up to 2TiB or long processing times for some decryption operations which involve the [Argon2 function](https://datatracker.ietf.org/doc/html/rfc9580.html#name-argon2). An attacker can provide a valid `Symmetric Key Encrypted Session Key` packet (SKESK) which uses `Argon2` for String-to-Key hashing with parameters that are excessive, but within specification limits of the RFC9580 OpenPGP standard. Since `rpgp` did not further restrict the Argon2 parameters, this can cause out-of-memory conditions and crash the `rpgp` process. Under some conditions,   the memory resource exhaustion may trigger other system instability. Alternatively, this can make the program unresponsive via long computations. The attacker needs to trick a victim into attempting decryption, but does not require knowledge of the symmetric secret used by the victim.\n\nThere is no impact to confidentiality or integrity security properties.\n\n### Versions and Patches\n\nThe impact details on the message parsing component varies with different versions. We\u0027ve confirmed some of the problematic behavior on older versions such as `v0.10.0` and see all recent versions as affected in some form.  \n\nThe affected `Argon2` functionality was introduced with `v0.12.0-alpha.1`, earlier versions are not vulnerable.\n\nThe vulnerabilities have been fixed with version `0.14.2`. We recommend all users to upgrade to this version.\n\n### References\n\n\nThe security audit was made possible by the [NLnet Foundation NGI Zero Core](https://nlnet.nl/core/) grant program [for rpgp](https://nlnet.nl/project/rPGP-cryptorefresh/).",
  "id": "GHSA-4grw-m28r-q285",
  "modified": "2024-12-05T19:05:49Z",
  "published": "2024-12-05T17:31:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rpgp/rpgp/security/advisories/GHSA-4grw-m28r-q285"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53857"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rpgp/rpgp"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "rPGP Potential Resource Exhaustion when handling Untrusted Messages"
}

FKIE_CVE-2024-53857

Vulnerability from fkie_nvd - Published: 2024-12-05 16:15 - Updated: 2024-12-05 16:15

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/rpgp/rpgp/security/advisories/GHSA-4grw-m28r-q285

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows attackers to trigger resource exhaustion vulnerabilities in rpgp by providing crafted messages. This affects general message parsing and decryption with symmetric keys."
    },
    {
      "lang": "es",
      "value": "rPGP es una implementaci\u00f3n pura de OpenPGP en Rust. Antes de la versi\u00f3n 0.14.1, rPGP permite a los atacantes activar vulnerabilidades de agotamiento de recursos en rpgp al proporcionar mensajes manipulados. Esto afecta el an\u00e1lisis y descifrado general de mensajes con claves sim\u00e9tricas."
    }
  ],
  "id": "CVE-2024-53857",
  "lastModified": "2024-12-05T16:15:26.393",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-12-05T16:15:26.393",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rpgp/rpgp/security/advisories/GHSA-4grw-m28r-q285"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-53857 (GCVE-0-2024-53857)

GHSA-4GRW-M28R-Q285

Impact

Versions and Patches

References

FKIE_CVE-2024-53857

Tags

Sightings

Nomenclature