{"id":"EUVD-2023-2608","enisaUuid":"f665b5dd-6bb8-36c9-9b25-128a00a75843","description":"phonenumber is a library for parsing, formatting and validating international phone numbers. Prior to versions `0.3.3+8.13.9` and `0.2.5+8.11.3`, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of `rust-phonenumber`, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string `.;phone-context\u003d`. Versions `0.3.3+8.13.9` and `0.2.5+8.11.3` contain a patch for this issue. There are no known workarounds.","datePublished":"Sep 19, 2023, 2:47:22 PM","dateUpdated":"Sep 24, 2024, 8:46:54 PM","baseScore":8.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","references":"https://github.com/whisperfish/rust-phonenumber/security/advisories/GHSA-whhr-7f2w-qqj2\nhttps://github.com/whisperfish/rust-phonenumber/commit/2dd44be94539c051b4dee55d1d9d349bd7bedde6\nhttps://github.com/whisperfish/rust-phonenumber/commit/bea8e732b9cada617ede5cf51663dba183747f71\n","aliases":"CVE-2023-42444\nGHSA-whhr-7f2w-qqj2\n","assigner":"GitHub_M","epss":0.87,"enisaIdProduct":[{"id":"6e4c4a6f-d2c4-374d-b923-86d579f74bf7","product":{"name":"rust-phonenumber","vendor":{"name":"whisperfish"}},"product_version":"\u003c 0.2.5+8.11.3"},{"id":"d9d6af13-71c6-300d-a847-1d714fbd72bc","product":{"name":"rust-phonenumber","vendor":{"name":"whisperfish"}},"product_version":"0.3.0, \u003c 0.3.3+8.3.19"}],"enisaIdVendor":[{"id":"a3a100ee-9eb5-33c2-906d-a73f3bf735ae","vendor":{"name":"whisperfish"}}],"enisaIdVulnerability":[{"id":"aa226d5b-a194-3f08-8b9a-c54332986324","vulnerability":{"id":"GHSA-whhr-7f2w-qqj2","description":"phonenumber panics on parsing crafted RFC3966 inputs","datePublished":"Sep 21, 2023, 5:10:57 PM","dateUpdated":"Mar 11, 2026, 8:35:22 PM","baseScore":null,"references":"https://github.com/whisperfish/rust-phonenumber/security/advisories/GHSA-whhr-7f2w-qqj2\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-42444\nhttps://github.com/whisperfish/rust-phonenumber/commit/2dd44be94539c051b4dee55d1d9d349bd7bedde6\nhttps://github.com/whisperfish/rust-phonenumber/commit/bea8e732b9cada617ede5cf51663dba183747f71\nhttps://github.com/whisperfish/rust-phonenumber\nhttps://rustsec.org/advisories/RUSTSEC-2023-0082.html\n","enisa_id":"EUVD-2023-2608\n","aliases":"GHSA-whhr-7f2w-qqj2\nCVE-2023-42444\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:48:40 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c4ee3014-cfe1-36dd-98c5-4ba5b7625a01","vulnerability":{"id":"CVE-2023-42444","description":"phonenumber is a library for parsing, formatting and validating international phone numbers. Prior to versions `0.3.3+8.13.9` and `0.2.5+8.11.3`, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of `rust-phonenumber`, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string `.;phone-context\u003d`. Versions `0.3.3+8.13.9` and `0.2.5+8.11.3` contain a patch for this issue. There are no known workarounds.","datePublished":"Sep 19, 2023, 2:47:22 PM","dateUpdated":"Sep 24, 2024, 8:46:54 PM","status":"PUBLISHED","baseScore":8.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","references":"https://github.com/whisperfish/rust-phonenumber/security/advisories/GHSA-whhr-7f2w-qqj2\nhttps://github.com/whisperfish/rust-phonenumber/commit/2dd44be94539c051b4dee55d1d9d349bd7bedde6\nhttps://github.com/whisperfish/rust-phonenumber/commit/bea8e732b9cada617ede5cf51663dba183747f71\n","enisa_id":"EUVD-2023-2608\n","assigner":"GitHub_M","epss":0.87,"dataProcessed":"Oct 31, 2026, 7:15:39 AM","vulnerabilityProduct":[{"id":"2280b5dc-bdaa-3113-b37a-ce8c7db68e95","product":{"name":"rust-phonenumber","vendor":{"name":"whisperfish"}},"product_version":"0.3.0, \u003c 0.3.3+8.3.19"},{"id":"5457e5b7-f504-47c2-93c9-8f66b7d6183d","product":{"name":"rust-phonenumber","vendor":{"name":"whisperfish"}},"product_version":"0.3.0, \u003c 0.3.3+8.3.19"},{"id":"827a8bec-8fe9-40ec-969a-3fc57c66391d","product":{"name":"rust-phonenumber","vendor":{"name":"whisperfish"}},"product_version":"\u003c 0.2.5+8.11.3"},{"id":"925e40c7-9972-3abd-9b49-06deb3f181f5","product":{"name":"rust-phonenumber","vendor":{"name":"whisperfish"}},"product_version":"\u003c 0.2.5+8.11.3"}],"vulnerabilityVendor":[{"id":"c1016c07-89f1-3475-b991-b6053025149b","vendor":{"name":"whisperfish"}}]}}],"enisaIdAdvisory":[]}