// For flags

CVE-2023-39914

BER/CER/DER decoder panics on invalid input

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

NLnet Labs’ bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding.

La biblioteca bder de NLnet Labs hasta la versión 0.7.2 incluida entra en pánico al decodificar ciertos datos de entrada no válidos en lugar de rechazar los datos con un error. Esto puede afectar tanto a la etapa de decodificación real como al acceso a contenidos de tipos que utilizaron decodificación retrasada.

NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding.

*Credits: Haya Shulman, Donika Mirdita, Niklas Vogel
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
None
Automatable
Yes
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2023-08-07 CVE Reserved
  • 2023-09-13 CVE Published
  • 2024-09-12 CVE Updated
  • 2024-09-19 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-228: Improper Handling of Syntactically Invalid Structure
  • CWE-232: Improper Handling of Undefined Values
  • CWE-240: Improper Handling of Inconsistent Structural Elements
CAPEC
References (1)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Nlnetlabs
Search vendor "Nlnetlabs"
Bcder
Search vendor "Nlnetlabs" for product "Bcder"
< 0.7.3
Search vendor "Nlnetlabs" for product "Bcder" and version " < 0.7.3"
-
Affected