CVE-2024-58261: High severity Sequoia OpenPGP vulnerability
The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messages for RawCertParser operations that encounter an unsupported primary key type.
Other sources
There is a denial-of-service vulnerability in sequoia-openpgp, our crate providing a low-level interface to our OpenPGP implementation. When triggered, the process will enter an infinite loop.
Many thanks to Andrew Gallagher for disclosing the issue to us.
Impact
Any software directly or indirectly using the interface sequoiaopenpgp::cert::raw::RawCertParser. Notably, this includes all software using the sequoiacertstore crate.
Details
The RawCertParser does not advance the input stream when encountering unsupported cert (primary key) versions, resulting in an infinite loop.
The fix introduces a new raw-cert-specific cert::raw::Error::UnuspportedCert.
Affected software
- sequoia-openpgp 1.13.0 - sequoia-openpgp 1.14.0 - sequoia-openpgp 1.15.0 - sequoia-openpgp 1.16.0 - sequoia-openpgp 1.17.0 - sequoia-openpgp 1.18.0 - sequoia-openpgp 1.19.0 - sequoia-openpgp 1.20.0 - Any software built against a vulnerable version of sequoia-openpgp which is directly or indirectly using the interface sequoiaopenpgp::cert::raw::RawCertParser. Notably, this includes all software using the sequoiacertstore crate.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58261?
CVE-2024-58261 is categorized as a moderate severity vulnerability due to the potential for infinite loops during RawCertParser operations.
How do I fix CVE-2024-58261?
To mitigate CVE-2024-58261, upgrade the sequoia-openpgp crate to version 1.21.0 or later.
What software is affected by CVE-2024-58261?
CVE-2024-58261 affects the sequoia-openpgp crate versions before 1.21.0.
What types of operations are impacted by CVE-2024-58261?
CVE-2024-58261 impacts RawCertParser operations that encounter unsupported primary key types.
Is CVE-2024-58261 a remote vulnerability?
CVE-2024-58261 does not denote a remote vulnerability but may cause denial of service during local operations.