CVE-2023-39914: nlnet labs bcder Improper Handling of Undefined Values
CVSS: 7.5v3.1HighModified
AliasesUBUNTU-CVE-2023-39914DEBIAN-CVE-2023-39914GHSA-6jmw-6mxw-w4jcRUSTSEC-2023-0062
Published 13-09-2023Last modified 12-09-2024
Vulnerability summary
CVE-2023-39914 is a high (CVSS 7.5) Improper Handling of Undefined Values vulnerability in nlnet labs bcder. EPSS estimates a 0.70% chance of exploitation in the next 30 days, higher than 52.3% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
0.70%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 13-09-2023PublishedVulnerability first disclosed.
- 12-09-2024Last modifiedVulnerability information updated.
Description
NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding.
CVSS metrics
5 scores · 5 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · Crates.ioEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.70%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
0.00 pp
From 0.70% on 19-09-2026
19-09-202619-10-2026
EPSS score0.70%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-232Improper Handling of Undefined ValuesThe product does not handle or incorrectly handles when a value is not defined or supported for the associated parameter, field, or argument name.
- CWE-240Improper Handling of Inconsistent Structural ElementsThe product does not handle or incorrectly handles when two or more structural elements should be consistent, but are not.
Affected systems
Crates.Io1 product
- bcder< 0.7.3 | ≥ 0.0.0-0, < 0.7.3
Debian1 product
- rust-bcderAll versions (No fix recorded) | < 0.7.3-1
Nlnet labs1 product
- bcder< 0.7.3
Nlnetlabs1 product
- bcder< 0.7.3
Ubuntu1 product
- rust-bcderAll versions (No fix recorded)
5 vendors · 5 products
References
10 links
- github.com/NLnetLabs/bcderPACKAGE
- crates.io/crates/bcderPACKAGE