CVE-2024-21909

PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of service vulnerability. An attacker may trigger the denial of service condition by providing crafted data to the DecodeFromBytes or other decoding mechanisms in PeterO.Cbor. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.

PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of service vulnerability. An attacker may trigger the denial of service condition by providing crafted data to the DecodeFromBytes or other decoding mechanisms in PeterO.Cbor. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.

### Impact Due to this library's use of an inefficient algorithm, it is vulnerable to a denial of service attack when a maliciously crafted input is passed to `DecodeFromBytes` or other CBOR decoding mechanisms in this library. Affected versions _include_ versions 4.0.0 through 4.5.0. This vulnerability was privately reported to me. ### Patches This issue has been fixed in version 4.5.1. Users should use the latest version of this library. (The latest version is not necessarily 4.5.1. Check the [NuGet page](https://www.nuget.org/packages/PeterO.Cbor) to see the latest version's version number.) ### Workarounds Again, users should use the latest version of this library. In the meantime, note that the inputs affected by this issue are all CBOR maps or contain CBOR maps. An input that decodes to a single CBOR object is not capable of containing a CBOR map if— - it begins with a byte other than 0x80 through 0xDF, or - it does not contain a byte in the range 0xa0 through 0xBF. Such an input is not affected by this vulnerability and an application can choose to perform this check before passing it to a CBOR decoding mechanism. ### For more information If you have any questions or comments about this advisory: * Open an issue in [the CBOR repository](https://github.com/peteroupc/CBOR).

### Impact Due to this library's use of an inefficient algorithm, it is vulnerable to a denial of service attack when a maliciously crafted input is passed to `DecodeFromBytes` or other CBOR decoding mechanisms in this library. Affected versions _include_ versions 4.0.0 through 4.5.0. This vulnerability was privately reported to me. ### Patches This issue has been fixed in version 4.5.1. Users should use the latest version of this library. (The latest version is not necessarily 4.5.1. Check the [NuGet page](https://www.nuget.org/packages/PeterO.Cbor) to see the latest version's version number.) ### Workarounds Again, users should use the latest version of this library. In the meantime, note that the inputs affected by this issue are all CBOR maps or contain CBOR maps. An input that decodes to a single CBOR object is not capable of containing a CBOR map if— - it begins with a byte other than 0x80 through 0xDF, or - it does not contain a byte in the range 0xa0 through 0xBF. Such an input is not affected by this vulnerability and an application can choose to perform this check before passing it to a CBOR decoding mechanism. ### For more information If you have any questions or comments about this advisory: * Open an issue in [the CBOR repository](https://github.com/peteroupc/CBOR).

Las versiones de PeterO.Cbor 4.0.0 a 4.5.0 son vulnerables a una vulnerabilidad de denegación de servicio. Un atacante puede desencadenar la condición de denegación de servicio proporcionando datos manipulados a DecodeFromBytes u otros mecanismos de decodificación en PeterO.Cbor. Dependiendo del uso de la biblioteca, un atacante remoto y no autenticado puede provocar la condición de denegación de servicio.