CVE-2024-39697

phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the "number" part potentially parses as a number larger than 2^56. This vulnerability is fixed in 0.3.6.

phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the "number" part potentially parses as a number larger than 2^56. This vulnerability is fixed in 0.3.6.

### Impact The phonenumber parsing code may panic due to a reachable `assert!` guard on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the "number" part potentially parses as a number larger than 2^56. Since f69abee1/0.3.4/#52. 0.2.x series is not affected. ### Patches Patches have been published as version `0.3.6+8.13.36`.

### Impact The phonenumber parsing code may panic due to a reachable `assert!` guard on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the "number" part potentially parses as a number larger than 2^56. Since f69abee1/0.3.4/#52. 0.2.x series is not affected. ### Patches Upgrade to 0.3.6 or higher. ### Workarounds n/a ### References Whereas https://github.com/whisperfish/rust-phonenumber/issues/69 did not provide an example code path, property testing found a few: `+dwPAA;phone-context=AA`.

phonenumber es una librería para analizar, formatear y validar números de teléfono internacionales. Desde 0.3.4, el código de análisis del número de teléfono puede entrar en pánico debido a un acceso fuera de los límites protegido contra pánico en la cadena del número de teléfono. En una implementación típica de Rust-phonenumber, esto puede desencadenarse al alimentar un número de teléfono creado con fines malintencionados, por ejemplo, a través de la red, específicamente cadenas del formato `+dwPAA;phone-context=AA`, donde la parte "number" potencialmente se analiza como un número mayor que 2^56. Esta vulnerabilidad se solucionó en 0.3.6.