VulnerabilityDeferred

CVE-2024-53857

Prior to 0.14.1, rPGP allows attackers to trigger resource exhaustion vulnerabilities in rpgp by providing crafted messages.

HIGH 7.5EPSS 0.47%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.47%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows attackers to trigger resource exhaustion vulnerabilities in rpgp by providing crafted messages. This affects general message parsing and decryption with symmetric keys.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.47% probability · 39th percentile
CISA KEV: Not listed
Weakness: CWE-770
Source: security-advisories@github.com

References

https://github.com/rpgp/rpgp/security/advisories/GHSA-4grw-m28r-q285

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.