Importantly, these constraints are actually required to be true in DER, but that correctness wasn't enforced on the early node parser side so it was incorrect to rely on it later on in decoding, which is what the library did.
These crashes can be triggered when parsing any DER/BER format object. There is no memory-safety issue here: the crash is a graceful one from the Swift runtime. The impact of this is that it can be used as a denial-of-service vector when parsing BER/DER data from unknown sources, e.g. when parsing TLS certificates.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2025-0068 | Swift ASN.1 can be caused to crash when parsing certain BER/DER constructions. This crash is caused by a confusion in the ASN.1 library itself which assumes that certain objects can only be provided in either constructed or primitive forms, and will trigger a preconditionFailure if that constraint isn't met. Importantly, these constraints are actually required to be true in DER, but that correctness wasn't enforced on the early node parser side so it was incorrect to rely on it later on in decoding, which is what the library did. These crashes can be triggered when parsing any DER/BER format object. There is no memory-safety issue here: the crash is a graceful one from the Swift runtime. The impact of this is that it can be used as a denial-of-service vector when parsing BER/DER data from unknown sources, e.g. when parsing TLS certificates. |
 Github GHSA |
GHSA-w8xv-rwgf-4fwh | CVE-2025-0343: Swift ASN.1 can crash when parsing maliciously formed BER/DER |
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Mon, 24 Mar 2025 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-228 | |
| Metrics |
cvssV3_1
|
Tue, 18 Feb 2025 22:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Wed, 15 Jan 2025 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Wed, 15 Jan 2025 01:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Swift ASN.1 can be caused to crash when parsing certain BER/DER constructions. This crash is caused by a confusion in the ASN.1 library itself which assumes that certain objects can only be provided in either constructed or primitive forms, and will trigger a preconditionFailure if that constraint isn't met. Importantly, these constraints are actually required to be true in DER, but that correctness wasn't enforced on the early node parser side so it was incorrect to rely on it later on in decoding, which is what the library did. These crashes can be triggered when parsing any DER/BER format object. There is no memory-safety issue here: the crash is a graceful one from the Swift runtime. The impact of this is that it can be used as a denial-of-service vector when parsing BER/DER data from unknown sources, e.g. when parsing TLS certificates. | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: Swift
Published:
Updated: 2025-03-24T16:07:03.833Z
Reserved: 2025-01-08T18:27:05.903Z
Link: CVE-2025-0343
Vulnrichment
Updated: 2025-01-15T15:01:24.502Z
NVD
Status : Awaiting Analysis
Published: 2025-01-15T01:15:13.673
Modified: 2025-03-24T16:15:33.270
Link: CVE-2025-0343
Redhat
No data.
OpenCVE Enrichment
No data.