{"id":"CVE-2021-45711","aliases":["GHSA-g4h2-4wvh-grc5","RUSTSEC-2021-0125"],"url":"https://o3.security/vulnerability/CVE-2021-45711","summary":"Panic on incorrect date input to `simple_asn1`","details":"Version 0.6.0 of the `simple_asn1` crate panics on certain malformed\ninputs to its parsing functions, including `from_der` and `der_decode`.\nBecause this crate is frequently used with inputs from the network, this\nshould be considered a security vulnerability.\n\nThe issue occurs when parsing the old ASN.1 \"UTCTime\" time format.  If an\nattacker provides a UTCTime where the first character is ASCII but the\nsecond character is above 0x7f, a string slice operation in the\n`from_der_` function will try to slice into the middle of a UTF-8\ncharacter, and cause a panic.\n\nThis error was introduced in commit\n[`d7d39d709577710e9dc8`](https://github.com/acw/simple_asn1/commit/d7d39d709577710e9dc8833ee57d200eef366db8),\nwhich updated `simple_asn1` to use `time` instead of `chrono` because of\n[`RUSTSEC-2020-159`](https://rustsec.org/advisories/RUSTSEC-2020-0159).\nVersions of `simple_asn1` before 0.6.0 are not affected by this issue.\n\nThe [patch](https://github.com/acw/simple_asn1/pull/28) was applied in\n`simple_asn1` version 0.6.1.\n","published":"2022-06-17T00:19:49Z","modified":"2023-11-08T04:07:23.302312Z","cvss":null,"epss":{"score":0.0134,"percentile":0.68759,"asOf":"2026-08-13"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"simple_asn1","fixedVersion":"0.6.1"}],"fix":{"url":"https://github.com/acw/simple_asn1/commit/d7d39d709577710e9dc8833ee57d200eef366db8","label":"acw/simple_asn1@d7d39d7"},"references":[{"type":"WEB","url":"https://github.com/acw/simple_asn1/issues/27"},{"type":"WEB","url":"https://github.com/acw/simple_asn1/commit/d7d39d709577710e9dc8833ee57d200eef366db8"},{"type":"PACKAGE","url":"https://github.com/acw/simple_asn1"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2021-0125.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2023-11-08T04:07:23.302312Z"}}