CVE-2024-39697 — phonenumber panics on parsing crafted phonenumber inputs

Affected: whisperfish rust-phonenumber, whisperfish phonenumber

phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the "number" part potentially parses as a number larger than 2^56. This vulnerability is fixed in 0.3.6.

GHSA-mjw4-jj88-v687 — panic on parsing crafted phonenumber inputs

Affected: crates.io: phonenumber

### Impact The phonenumber parsing code may panic due to a reachable `assert!` guard on the phonenumber string.

In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the "number" part potentially parses as a number larger than 2^56.

Since f69abee1/0.3.4/#52.

0.2.x series is not affected.

### Patches Upgrade to 0.3.6 or higher.

### Workarounds n/a

### References Whereas https://github.com/whisperfish/rust-phonenumber/issues/69 did not provide an example code path, property testing found a few: `+dwPAA;phone-context=AA`.

Most recent entries from all

CVE-2024-39697 — phonenumber panics on parsing crafted phonenumber inputs

GHSA-mjw4-jj88-v687 — panic on parsing crafted phonenumber inputs