{"id":"RUSTSEC-2020-0068","summary":"Unexpected panic in multihash `from_slice` parsing code","details":"In versions prior 0.11.3 it's possible to make `from_slice` panic by feeding it certain malformed input.\nIt's never documented that `from_slice` (and `from_bytes` which wraps it) can panic, and its' return type (`Result\u003cSelf, DecodeError\u003e`) suggests otherwise.\n\nIn practice, `from_slice`/`from_bytes` is frequently used in networking code (for example [in rust-libp2p](https://github.com/libp2p/rust-libp2p/blob/7b415d5e7040e45c541f76f2c409e63d4d3249c6/core/src/peer_id.rs#L89)) and is being called with unsanitized data from untrusted sources.\nThis can allow attackers to cause DoS by causing an unexpected `panic` in the network client's code.","aliases":["CVE-2020-35909","GHSA-h7qh-3h6f-w79p"],"modified":"2023-11-01T04:53:07.857161Z","published":"2020-11-08T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/multihash"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2020-0068.html"},{"type":"WEB","url":"https://github.com/multiformats/rust-multihash/pull/72"}],"affected":[{"package":{"name":"multihash","ecosystem":"crates.io","purl":"pkg:cargo/multihash"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.11.3"}]}],"ecosystem_specific":{"affects":{"os":[],"functions":["multihash::digests::MultihashGeneric::from_bytes","multihash::digests::MultihashRefGeneric::from_slice"],"arch":[]},"affected_functions":null},"database_specific":{"cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2020-0068.json","categories":["denial-of-service"]}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}