CVE-2023-42444High· 8.6▾ Twilightphonenumber: panic on parsing crafted RF3966 phonenumber inputs
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.9%
The phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string.
In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string .;phone-context=.
Patches will be published as version 0.3.3+8.13.9 and backported as 0.2.5+8.11.3.
phonenumber >= 0.3.0, < 0.3.3Upgrade to a patched release:
phonenumber 0.3.3Connected by shared product, vendor, weakness, or advisory.