jstedfast/mimekit · Security
Mimekit has vulnerable dependency that can lead to denial of service
- GHSA ID
- GHSA-gmc6-fwg3-75m5
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v4
- 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Description
Summary
Denial of service vulnerability.
Details
See: https://github.com/advisories/GHSA-447r-wph3-92pm and https://github.com/dotnet/announcements/issues/312
PoC
Update System.Security.Cryptography.Pkcs to 8.0.1 so that the transitive dependency with the issue gets updated
Impact
Denial of service vulnerability. Affects MimeKit (>= v3.0.0 and <= v4.7.0) when used to decrypt or verify incoming S/MIME messages as well as importing 3rd-party X.509 certificates for use with encrypting outgoing S/MIME messages.
CWEs
- CWE-20 · Improper Input Validation
References
- https://github.com/jstedfast/MimeKit/security/advisories/GHSA-gmc6-fwg3-75m5 ↗
- https://github.com/dotnet/announcements/issues/312 ↗
- https://github.com/jstedfast/MimeKit/commit/aef4eda75525848b992ce5e1f9b87399000fffb6 ↗
- https://github.com/advisories/GHSA-447r-wph3-92pm ↗
- https://github.com/advisories/GHSA-gmc6-fwg3-75m5 ↗