CVE-2023-42444

CVSS V2 None CVSS V3 None

Description

phonenumber is a library for parsing, formatting and validating international phone numbers. Prior to versions `0.3.3+8.13.9` and `0.2.5+8.11.3`, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of `rust-phonenumber`, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string `.;phone-context=`. Versions `0.3.3+8.13.9` and `0.2.5+8.11.3` contain a patch for this issue. There are no known workarounds.

Overview

CVE ID
CVE-2023-42444

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2023-09-19T14:47:22.026Z

Last Modified Date
2023-09-19T14:47:22.026Z

Weakness Enumerations

CWE	URL
CWE-248	http://cwe.mitre.org/data/definitions/248.html
CWE-392	http://cwe.mitre.org/data/definitions/392.html
CWE-1284	http://cwe.mitre.org/data/definitions/1284.html

References

Reference URL	Reference Tags
https://github.com/whisperfish/rust-phonenumber/security/advisories/GHSA-whhr-7f2w-qqj2	x_refsource_CONFIRM
https://github.com/whisperfish/rust-phonenumber/commit/2dd44be94539c051b4dee55d1d9d349bd7bedde6	x_refsource_MISC
https://github.com/whisperfish/rust-phonenumber/commit/bea8e732b9cada617ede5cf51663dba183747f71	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-42444
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42444

History

Created	Old Value	New Value	Data Type	Notes
2024-06-25 13:34:10				Added to TrackCVE