https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 12:26:48 +0000 https://cve.radiocsirt.org/vuln/cve-2024-53856 <p><strong>Affected:</strong> rpgp</p> <p>rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows an attacker to trigger rpgp crashes by providing crafted data. This vulnerability is fixed in 0.14.1.</p> <p><strong>Affected:</strong> rpgp</p> <p>rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows an attacker to trigger rpgp crashes by providing crafted data. This vulnerability is fixed in 0.14.1.</p> https://cve.radiocsirt.org/vuln/cve-2024-53856 https://cve.radiocsirt.org/vuln/ghsa-9rmp-2568-59rv <p><strong>Affected:</strong> crates.io: pgp</p> <p>During a security audit, [Radically Open Security](https://www.radicallyopensecurity.com/) discovered several reachable edge cases which allow an attacker to trigger `rpgp` crashes by providing crafted data.</p> <p>### Impact When processing malformed input, `rpgp` can run into Rust panics which halt the program.</p> <p>This can happen in the following scenarios: * Parsing OpenPGP messages from binary or armor format * Decrypting OpenPGP messages via `decrypt_with_password()` * Parsing or converting public keys * Parsing signed cleartext messages from armor format * Using malformed private keys to sign or encrypt</p> <p>Given the affected components, we consider most attack vectors to be reachable by remote attackers during typical use cases of the `rpgp` library. The attack complexity is low since the malformed messages are generic, short, and require no victim-specific knowledge.</p> <p>The result is a denial-of-service impact via program termination. There is no impact to confidentiality or integrity security properties.</p> <p>### Versions and Patches All recent versions are affected by at least some of the above mentioned issues.</p> <p>The vulnerabilities have been fixed with version `0.14.1`. We recommend all users to upgrade to this version.</p> <p>### References</p> <p>The security audit was made possible by the [NLnet Foundation NGI Zero Core](https://nlnet.nl/core/) grant program [for rpgp](https://nlnet.nl/project/rPGP-cryptorefresh/).</p> <p><strong>Affected:</strong> crates.io: pgp</p> <p>During a security audit, [Radically Open Security](https://www.radicallyopensecurity.com/) discovered several reachable edge cases which allow an attacker to trigger `rpgp` crashes by providing crafted data.</p> <p>### Impact When processing malformed input, `rpgp` can run into Rust panics which halt the program.</p> <p>This can happen in the following scenarios: * Parsing OpenPGP messages from binary or armor format * Decrypting OpenPGP messages via `decrypt_with_password()` * Parsing or converting public keys * Parsing signed cleartext messages from armor format * Using malformed private keys to sign or encrypt</p> <p>Given the affected components, we consider most attack vectors to be reachable by remote attackers during typical use cases of the `rpgp` library. The attack complexity is low since the malformed messages are generic, short, and require no victim-specific knowledge.</p> <p>The result is a denial-of-service impact via program termination. There is no impact to confidentiality or integrity security properties.</p> <p>### Versions and Patches All recent versions are affected by at least some of the above mentioned issues.</p> <p>The vulnerabilities have been fixed with version `0.14.1`. We recommend all users to upgrade to this version.</p> <p>### References</p> <p>The security audit was made possible by the [NLnet Foundation NGI Zero Core](https://nlnet.nl/core/) grant program [for rpgp](https://nlnet.nl/project/rPGP-cryptorefresh/).</p> https://cve.radiocsirt.org/vuln/ghsa-9rmp-2568-59rv