Open-source package vulnerability · Rust (crates.io)

CVE-2024-39697: panic on parsing crafted phonenumber inputs

criticalCVSS 4.0 9.2 · 3.1 8.6GHSA-mjw4-jj88-v687

Impact The phonenumber parsing code may panic due to a reachable assert! guard on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form +dwPAA;phone-context=AA, where the "number" part potentially parses as a number larger than 2^56. Since f69abee1/0.3.4/#52.

Published Jul 9, 2024 · Updated Nov 18, 2024

Affected packages

phonenumber

Ecosystem: Rust (crates.io)
Affected: >= 0.3.4, < 0.3.6
Fixed in: 0.3.6
Check: cargo tree -i phonenumber

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

The phonenumber parsing code may panic due to a reachable assert! guard on the phonenumber string.

In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form +dwPAA;phone-context=AA, where the "number" part potentially parses as a number larger than 2^56.

Since f69abee1/0.3.4/#52.

0.2.x series is not affected.

Patches

Upgrade to 0.3.6 or higher.

Workarounds

n/a

References

Whereas https://github.com/whisperfish/rust-phonenumber/issues/69 did not provide an example code path, property testing found a few: +dwPAA;phone-context=AA.

Credited to rubdos.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology