CVE-2023-53160: Medium severity Rust sequoia-openpgp vulnerability
Affected versions of the crate have several bugs where attacker-controlled input can result in the use of an out-of-bound array index. Rust detects the use of the out-of-bound index and causes the application to panic. An attacker may be able to use this to cause a denial-of-service. However, it is not possible for an attacker to read from or write to the application's address space.
Other sources
The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-53160?
CVE-2023-53160 is classified as a medium severity vulnerability due to the potential for out-of-bounds array access leading to application panics.
How do I fix CVE-2023-53160?
To fix CVE-2023-53160, upgrade the sequoia-openpgp crate to version 1.16.0 or later.
What types of software are affected by CVE-2023-53160?
CVE-2023-53160 affects the sequoia-openpgp crate in Rust versions prior to 1.16.0.
What kind of issues can CVE-2023-53160 cause in applications?
CVE-2023-53160 can cause applications to panic due to unhandled out-of-bounds array access.
Is CVE-2023-53160 publicly disclosed?
Yes, CVE-2023-53160 has been publicly disclosed and detailed in various security advisories.