Description

Possible leak of key's raw field if declared length is incorrect

Impact

If a field of a key is shorter than it is declared to be, the parser raises an error with a message containing the raw field value. An attacker able to modify the declared length of a key's sensitive field can thus expose the raw value of that field.

Patches

Upgrade to version 0.0.6, which no longer includes the raw field value in the error message.

Workarounds

N/A

References

N/A

For more information

If you have any questions or comments about this advisory:

Open an issue in openssh_key_parser

Mitigation

Aliases

References