GHSA-rv9v-r4vm-gj8xMediumCVSS 7.5
Miniscript allows stack consumption
🔗 CVE IDs covered (1)
📋 Description
The Miniscript (aka rust-miniscript) library for Rust allows stack consumption because it does not properly track tree depth.
🎯 Affected products4
- rust/miniscript:>= 12.0.0, < 12.2.0
- rust/miniscript:>= 11.0.0, < 11.2.0
- rust/miniscript:>= 10.0.0, < 10.2.0
- rust/miniscript:< 9.2.0
🔗 References (11)
- https://nvd.nist.gov/vuln/detail/CVE-2024-44073
- https://github.com/rust-bitcoin/rust-miniscript/pull/704
- https://github.com/rust-bitcoin/rust-miniscript/pull/712
- https://github.com/rust-bitcoin/rust-miniscript/compare/11.2.0...12.2.0
- https://github.com/rust-bitcoin/rust-miniscript/commit/5b0f5e3417f027a22b066debf825dbe6644b575b
- https://github.com/rust-bitcoin/rust-miniscript/commit/8f54b5e3fb7129ed9fbed53f1cb9e6e62ea4c151
- https://github.com/rust-bitcoin/rust-miniscript/pull/712/files
- https://github.com/rust-bitcoin/rust-miniscript/pull/713/files
- https://github.com/rust-bitcoin/rust-miniscript/pull/714/files
- https://github.com/rust-bitcoin/rust-miniscript/pull/715/files
- https://github.com/advisories/GHSA-rv9v-r4vm-gj8x