{"id":"CVE-2021-45711","aliases":["EUVD-2022-0594","GHSA-3m6f-3gfg-4x56","GHSA-g4h2-4wvh-grc5","RUSTSEC-2021-0125"],"status":"published","title":"Panic on incorrect date input to `simple_asn1`","description":"An issue was discovered in the simple_asn1 crate 0.6.0 before 0.6.1 for Rust. There is a panic if UTCTime data, supplied by a remote attacker, has a second character greater than 0x7f.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01384,"percentile":0.72549,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-400"],"published":"2021-11-14T12:00:00Z","modified":"2026-06-17T04:13:59Z","fixes":[{"ecosystem":"crates.io","package":"simple_asn1","fixed_in":["0.6.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"simple_asn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.6.0"},{"last_affected":"0.6.0"},{"fixed":"0.6.1"}]}],"versions":["0.6.0"]},{"source":"ghsa","ecosystem":"crates.io","package":"simple_asn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.6.0"},{"last_affected":"0.6.0"},{"fixed":"0.6.1"}]}],"versions":["0.6.0"]},{"source":"osv","ecosystem":"crates.io","package":"simple_asn1","ranges":[{"type":"SEMVER","events":[{"introduced":"0.6.0"},{"fixed":"0.6.1"}]}],"versions":["0.6.0"]},{"source":"osv","ecosystem":"crates.io","package":"simple_asn1","ranges":[{"type":"SEMVER","events":[{"introduced":"0.6.0"},{"fixed":"0.6.1"}]}],"versions":["0.6.0"]},{"source":"osv","ecosystem":"crates.io","package":"simple_asn1","ranges":[{"type":"SEMVER","events":[{"introduced":"0.6.0"},{"fixed":"0.6.1"}]}]}],"products":[{"vendor":"simple_asn1_project","product":"simple_asn1"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2021-0125.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web","advisory"]},{"url":"https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/simple_asn1/RUSTSEC-2021-0125.md","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web"]},{"url":"https://github.com/acw/simple_asn1/issues/27","tags":["web","report"]},{"url":"https://github.com/acw/simple_asn1/commit/d7d39d709577710e9dc8833ee57d200eef366db8","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3m6f-3gfg-4x56"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45711","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g4h2-4wvh-grc5"},{"url":"https://github.com/acw/simple_asn1","tags":["package"]},{"url":"https://crates.io/crates/simple_asn1","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-45711","description":"An issue was discovered in the simple_asn1 crate 0.6.0 before 0.6.1 for Rust. There is a panic if UTCTime data, supplied by a remote attacker, has a second character greater than 0x7f.","status":"published","published":"2021-12-26T21:47:07Z","modified":"2024-08-04T04:47:02.113Z","updated_at":"2026-11-02T14:33:02.580561Z"}],"euvd":[{"id":"EUVD-2022-0594","description":"An issue was discovered in the simple_asn1 crate 0.6.0 before 0.6.1 for Rust. There is a panic if UTCTime data, supplied by a remote attacker, has a second character greater than 0x7f.","status":"published","published":"2021-12-26T21:47:07Z","modified":"2024-08-04T04:47:02Z","updated_at":"2026-11-03T03:08:25.77408Z"}],"ghsa":[{"id":"GHSA-g4h2-4wvh-grc5","title":"Uncontrolled Resource Consumption in simple_asn1","description":"An issue was discovered in the simple_asn1 crate 0.6.0 before 0.6.1 for Rust. There is a panic if UTCTime data, supplied by a remote attacker, has a second character greater than 0x7f.","status":"published","published":"2022-01-06T22:05:05Z","modified":"2023-06-13T20:40:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:36:54.225318Z"},{"id":"GHSA-3m6f-3gfg-4x56","title":"Panic on incorrect date input to `simple_asn1`","description":"Version 0.6.0 of the `simple_asn1` crate panics on certain malformed\ninputs to its parsing functions, including `from_der` and `der_decode`.\nBecause this crate is frequently used with inputs from the network, this\nshould be considered a security vulnerability.\n\nThe issue occurs when parsing the old ASN.1 \"UTCTime\" time format.  If an\nattacker provides a UTCTime where the first character is ASCII but the\nsecond character is above 0x7f, a string slice operation in the\n`from_der_` function will try to slice into the middle of a UTF-8\ncharacter, and cause a panic.\n\nThis error was introduced in commit\n[`d7d39d709577710e9dc8`](https://github.com/acw/simple_asn1/commit/d7d39d709577710e9dc8833ee57d200eef366db8),\nwhich updated `simple_asn1` to use `time` instead of `chrono` because of\n[`RUSTSEC-2020-159`](https://rustsec.org/advisories/RUSTSEC-2020-0159).\nVersions of `simple_asn1` before 0.6.0 are not affected by this issue.\n\nThe [patch](https://github.com/acw/simple_asn1/pull/28) was applied in\n`simple_asn1` version 0.6.1.\n","status":"published","published":"2022-06-17T00:19:49Z","modified":"2023-06-13T20:38:49Z","updated_at":"2026-11-02T14:36:54.225318Z"}],"nvd":[{"id":"CVE-2021-45711","description":"An issue was discovered in the simple_asn1 crate 0.6.0 before 0.6.1 for Rust. There is a panic if UTCTime data, supplied by a remote attacker, has a second character greater than 0x7f.","status":"published","published":"2021-12-27T00:15:10.097Z","modified":"2026-06-17T04:13:59.86Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:07:02.977492Z"}],"osv":[{"id":"GHSA-g4h2-4wvh-grc5","title":"Uncontrolled Resource Consumption in simple_asn1","description":"An issue was discovered in the simple_asn1 crate 0.6.0 before 0.6.1 for Rust. There is a panic if UTCTime data, supplied by a remote attacker, has a second character greater than 0x7f.","status":"published","published":"2022-01-06T22:05:05Z","modified":"2023-11-08T04:07:23.302312Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"GHSA-3m6f-3gfg-4x56","title":"Panic on incorrect date input to `simple_asn1`","description":"Version 0.6.0 of the `simple_asn1` crate panics on certain malformed\ninputs to its parsing functions, including `from_der` and `der_decode`.\nBecause this crate is frequently used with inputs from the network, this\nshould be considered a security vulnerability.\n\nThe issue occurs when parsing the old ASN.1 \"UTCTime\" time format.  If an\nattacker provides a UTCTime where the first character is ASCII but the\nsecond character is above 0x7f, a string slice operation in the\n`from_der_` function will try to slice into the middle of a UTF-8\ncharacter, and cause a panic.\n\nThis error was introduced in commit\n[`d7d39d709577710e9dc8`](https://github.com/acw/simple_asn1/commit/d7d39d709577710e9dc8833ee57d200eef366db8),\nwhich updated `simple_asn1` to use `time` instead of `chrono` because of\n[`RUSTSEC-2020-159`](https://rustsec.org/advisories/RUSTSEC-2020-0159).\nVersions of `simple_asn1` before 0.6.0 are not affected by this issue.\n\nThe [patch](https://github.com/acw/simple_asn1/pull/28) was applied in\n`simple_asn1` version 0.6.1.\n","status":"published","published":"2022-06-17T00:19:49Z","modified":"2023-11-08T04:07:23.302312Z","updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"RUSTSEC-2021-0125","title":"Panic on incorrect date input to `simple_asn1`","description":"Version 0.6.0 of the `simple_asn1` crate panics on certain malformed\ninputs to its parsing functions, including `from_der` and `der_decode`.\nBecause this crate is frequently used with inputs from the network, this\nshould be considered a security vulnerability.\n\nThe issue occurs when parsing the old ASN.1 \"UTCTime\" time format.  If an\nattacker provides a UTCTime where the first character is ASCII but the\nsecond character is above 0x7f, a string slice operation in the\n`from_der_` function will try to slice into the middle of a UTF-8\ncharacter, and cause a panic.\n\nThis error was introduced in commit\n[`d7d39d709577710e9dc8`](https://github.com/acw/simple_asn1/commit/d7d39d709577710e9dc8833ee57d200eef366db8),\nwhich updated `simple_asn1` to use `time` instead of `chrono` because of\n[`RUSTSEC-2020-159`](https://rustsec.org/advisories/RUSTSEC-2020-0159).\nVersions of `simple_asn1` before 0.6.0 are not affected by this issue.\n\nThe [patch](https://github.com/acw/simple_asn1/pull/28) was applied in\n`simple_asn1` version 0.6.1.","status":"published","published":"2021-11-14T12:00:00Z","modified":"2023-11-08T04:07:23.302312Z","updated_at":"2026-11-02T15:53:39.492624Z"}]}}