Description
A remote attacker can supply a short X-Wing HPKE encapsulated key and trigger an out-of-bounds read in the C decapsulation path, potentially causing a crash or memory disclosure depending on runtime protections. This issue is fixed in swift-crypto version 4.3.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apple | macOS | 4.0.0 – < 4.3.1 | 4.3.1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| SwiftURL | swift-crypto | >= 4.0.0, < 4.3.1 | 4.3.1 | GHSA-9m44-rr2w-ppp7 |