Read the docs
TI-2022-26590 Aliases GHSA-3m6f-3gfg-4x56

Panic on incorrect date input to `simple_asn1`

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

Version 0.6.0 of the `simple_asn1` crate panics on certain malformed inputs to its parsing functions, including `from_der` and `der_decode`. Because this crate is frequently used with inputs from the network, this should be considered a security vulnerability. The issue occurs when parsing the old ASN.1 "UTCTime" time format. If an attacker provides a UTCTime where the first character is ASCII but the second character is above 0x7f, a string slice operation in the `from_der_` function will try to slice into the middle of a UTF-8 character, and cause a panic. This error was introduced in commit [`d7d39d709577710e9dc8`](https://github.com/acw/simple_asn1/commit/d7d39d709577710e9dc8833ee57d200eef366db8), which updated `simple_asn1` to use `time` instead of `chrono` because of [`RUSTSEC-2020-159`](https://rustsec.org/advisories/RUSTSEC-2020-0159). Versions of `simple_asn1` before 0.6.0 are not affected by this issue. The [patch](https://github.com/acw/simple_asn1/pull/28) was applied in `simple_asn1` version 0.6.1.

Why it matters now

Fix Fixed simple_asn1 (crates.io): 0.6.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—simple_asn1 (crates.io)0.6.0 to before 0.6.10.6.1Patch availableGHSA-3m6f-3gfg-4x56
  • simple_asn1 (crates.io) Vendor— Affected 0.6.0 to before 0.6.1 Fixed in 0.6.1 Patch available GHSA-3m6f-3gfg-4x56

Remediation

  • Fix · GHSA-3m6f-3gfg-4x56 simple_asn1 (crates.io) Fixed in 0.6.1 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-3m6f-3gfg-4x56

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences