https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 11:38:01 +0000 https://cve.radiocsirt.org/vuln/cve-2021-45711 <p>An issue was discovered in the simple_asn1 crate 0.6.0 before 0.6.1 for Rust. There is a panic if UTCTime data, supplied by a remote attacker, has a second character greater than 0x7f.</p> <p>An issue was discovered in the simple_asn1 crate 0.6.0 before 0.6.1 for Rust. There is a panic if UTCTime data, supplied by a remote attacker, has a second character greater than 0x7f.</p> https://cve.radiocsirt.org/vuln/cve-2021-45711 https://cve.radiocsirt.org/vuln/ghsa-3m6f-3gfg-4x56 <p><strong>Affected:</strong> crates.io: simple_asn1</p> <p>Version 0.6.0 of the `simple_asn1` crate panics on certain malformed inputs to its parsing functions, including `from_der` and `der_decode`. Because this crate is frequently used with inputs from the network, this should be considered a security vulnerability.</p> <p>The issue occurs when parsing the old ASN.1 &#34;UTCTime&#34; time format. If an attacker provides a UTCTime where the first character is ASCII but the second character is above 0x7f, a string slice operation in the `from_der_` function will try to slice into the middle of a UTF-8 character, and cause a panic.</p> <p>This error was introduced in commit [`d7d39d709577710e9dc8`](https://github.com/acw/simple_asn1/commit/d7d39d709577710e9dc8833ee57d200eef366db8), which updated `simple_asn1` to use `time` instead of `chrono` because of [`RUSTSEC-2020-159`](https://rustsec.org/advisories/RUSTSEC-2020-0159). Versions of `simple_asn1` before 0.6.0 are not affected by this issue.</p> <p>The [patch](https://github.com/acw/simple_asn1/pull/28) was applied in `simple_asn1` version 0.6.1.</p> <p><strong>Affected:</strong> crates.io: simple_asn1</p> <p>Version 0.6.0 of the `simple_asn1` crate panics on certain malformed inputs to its parsing functions, including `from_der` and `der_decode`. Because this crate is frequently used with inputs from the network, this should be considered a security vulnerability.</p> <p>The issue occurs when parsing the old ASN.1 &#34;UTCTime&#34; time format. If an attacker provides a UTCTime where the first character is ASCII but the second character is above 0x7f, a string slice operation in the `from_der_` function will try to slice into the middle of a UTF-8 character, and cause a panic.</p> <p>This error was introduced in commit [`d7d39d709577710e9dc8`](https://github.com/acw/simple_asn1/commit/d7d39d709577710e9dc8833ee57d200eef366db8), which updated `simple_asn1` to use `time` instead of `chrono` because of [`RUSTSEC-2020-159`](https://rustsec.org/advisories/RUSTSEC-2020-0159). Versions of `simple_asn1` before 0.6.0 are not affected by this issue.</p> <p>The [patch](https://github.com/acw/simple_asn1/pull/28) was applied in `simple_asn1` version 0.6.1.</p> https://cve.radiocsirt.org/vuln/ghsa-3m6f-3gfg-4x56