CVE-2024-44073 - Vulnerability Details - OpenCVE

The Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00084.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Rust-bitcoin	Miniscript

Configuration 1 [-]

cpe:2.3:a:rust-bitcoin:miniscript:*:*:*:*:*:rust:*:*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/rust-bitcoin/rust-miniscript/compare/11.2.0...12.2.0
https://github.com/rust-bitcoin/rust-miniscript/pull/704
https://github.com/rust-bitcoin/rust-miniscript/pull/712

History

Fri, 06 Sep 2024 17:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-674
CPEs		cpe:2.3:a:rust-bitcoin:miniscript::::::::
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 21 Aug 2024 13:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Rust-bitcoin Rust-bitcoin miniscript
Weaknesses		CWE-787
CPEs		cpe:2.3:a:rust-bitcoin:miniscript::::::rust::*
Vendors & Products		Rust-bitcoin Rust-bitcoin miniscript
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Mon, 19 Aug 2024 02:30:00 +0000

Type	Values Removed	Values Added
Description		The Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth.
References		https://github.com/rust-bitcoin/rust-miniscript/compare/11.2.0...12.2.0 https://github.com/rust-bitcoin/rust-miniscript/pull/704 https://github.com/rust-bitcoin/rust-miniscript/pull/712

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-08-19T00:00:00

Updated: 2024-09-13T13:28:09.838Z

Reserved: 2024-08-19T00:00:00

Link: CVE-2024-44073

Vulnrichment

Updated: 2024-08-19T18:02:57.820Z

NVD

Status : Modified

Published: 2024-08-19T03:15:03.790

Modified: 2024-09-06T17:35:17.523

Link: CVE-2024-44073

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-44073", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-09-13T13:28:09.838Z", "dateReserved": "2024-08-19T00:00:00", "datePublished": "2024-08-19T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-08-19T02:21:44.282743"}, "descriptions": [{"lang": "en", "value": "The Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/rust-bitcoin/rust-miniscript/pull/712"}, {"url": "https://github.com/rust-bitcoin/rust-miniscript/pull/704"}, {"url": "https://github.com/rust-bitcoin/rust-miniscript/compare/11.2.0...12.2.0"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-674", "lang": "en", "description": "CWE-674 Uncontrolled Recursion"}]}], "affected": [{"vendor": "rust-bitcoin", "product": "miniscript", "cpes": ["cpe:2.3:a:rust-bitcoin:miniscript:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "12.2.0", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-08-19T18:04:08.472953Z", "id": "CVE-2024-44073", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-13T13:28:09.838Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-44073", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-19T18:04:08.472953Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:rust-bitcoin:miniscript:*:*:*:*:*:*:*:*"], "vendor": "rust-bitcoin", "product": "miniscript", "versions": [{"status": "affected", "version": "0", "lessThan": "12.2.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-674", "description": "CWE-674 Uncontrolled Recursion"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-19T18:02:57.820Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/rust-bitcoin/rust-miniscript/pull/712"}, {"url": "https://github.com/rust-bitcoin/rust-miniscript/pull/704"}, {"url": "https://github.com/rust-bitcoin/rust-miniscript/compare/11.2.0...12.2.0"}], "descriptions": [{"lang": "en", "value": "The Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-08-19T02:21:44.282743"}}}, "cveMetadata": {"cveId": "CVE-2024-44073", "state": "PUBLISHED", "dateUpdated": "2024-09-13T13:28:09.838Z", "dateReserved": "2024-08-19T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-08-19T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rust-bitcoin:miniscript:*:*:*:*:*:rust:*:*", "matchCriteriaId": "C9827DEF-0B33-46B0-90DE-FFCA748732B9", "versionEndExcluding": "12.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth."}, {"lang": "es", "value": "La librer\u00eda Miniscript (tambi\u00e9n conocida como rust-miniscript) anterior a 12.2.0 para Rust permite el consumo de pila porque no realiza un seguimiento adecuado de la profundidad del \u00e1rbol."}], "id": "CVE-2024-44073", "lastModified": "2024-09-06T17:35:17.523", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-08-19T03:15:03.790", "references": [{"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/rust-bitcoin/rust-miniscript/compare/11.2.0...12.2.0"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/rust-bitcoin/rust-miniscript/pull/704"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/rust-bitcoin/rust-miniscript/pull/712"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-674"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}