{"id":"EUVD-2024-2383","enisaUuid":"2914be31-4c9a-3c6c-aca9-d4b016fc7de3","description":"phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context\u003dAA`, where the \"number\" part potentially parses as a number larger than 2^56. This vulnerability is fixed in 0.3.6.","datePublished":"Jul 9, 2024, 2:16:38 PM","dateUpdated":"Aug 2, 2024, 4:26:16 AM","baseScore":8.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","references":"https://github.com/whisperfish/rust-phonenumber/security/advisories/GHSA-mjw4-jj88-v687\nhttps://github.com/whisperfish/rust-phonenumber/issues/69\nhttps://github.com/whisperfish/rust-phonenumber/pull/52\nhttps://github.com/whisperfish/rust-phonenumber/commit/b792151b17fc90231c232a23935830c2266f3203\nhttps://github.com/whisperfish/rust-phonenumber/commit/f69abee1481fac0d6d531407bae90020e39c6407\n","aliases":"CVE-2024-39697\nGHSA-mjw4-jj88-v687\n","assigner":"GitHub_M","epss":0.71,"enisaIdProduct":[{"id":"8ad5f5ef-b2e8-329b-82f3-fa2025c25efa","product":{"name":"rust-phonenumber","vendor":{"name":"whisperfish"}},"product_version":"0.3.4, \u003c 0.3.6"}],"enisaIdVendor":[{"id":"74a47ebb-e7ef-3e19-aebe-ab76a152b3e4","vendor":{"name":"whisperfish"}}],"enisaIdVulnerability":[{"id":"22b2bdc2-e9e3-37ac-93a9-056058a3a268","vulnerability":{"id":"GHSA-mjw4-jj88-v687","description":"panic on parsing crafted phonenumber inputs","datePublished":"Jul 9, 2024, 2:13:48 PM","dateUpdated":"Nov 18, 2024, 4:26:50 PM","baseScore":null,"references":"https://github.com/whisperfish/rust-phonenumber/security/advisories/GHSA-mjw4-jj88-v687\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-39697\nhttps://github.com/whisperfish/rust-phonenumber/issues/69\nhttps://github.com/whisperfish/rust-phonenumber/pull/52\nhttps://github.com/whisperfish/rust-phonenumber/commit/b792151b17fc90231c232a23935830c2266f3203\nhttps://github.com/whisperfish/rust-phonenumber/commit/f69abee1481fac0d6d531407bae90020e39c6407\nhttps://github.com/whisperfish/rust-phonenumber\nhttps://rustsec.org/advisories/RUSTSEC-2024-0369.html\n","enisa_id":"EUVD-2024-2383\n","aliases":"GHSA-mjw4-jj88-v687\nCVE-2024-39697\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:09:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b49add80-56f9-3dc1-bf56-615a147c0914","vulnerability":{"id":"CVE-2024-39697","description":"phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context\u003dAA`, where the \"number\" part potentially parses as a number larger than 2^56. This vulnerability is fixed in 0.3.6.","datePublished":"Jul 9, 2024, 2:16:38 PM","dateUpdated":"Aug 2, 2024, 4:26:16 AM","status":"PUBLISHED","baseScore":8.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","references":"https://github.com/whisperfish/rust-phonenumber/security/advisories/GHSA-mjw4-jj88-v687\nhttps://github.com/whisperfish/rust-phonenumber/issues/69\nhttps://github.com/whisperfish/rust-phonenumber/pull/52\nhttps://github.com/whisperfish/rust-phonenumber/commit/b792151b17fc90231c232a23935830c2266f3203\nhttps://github.com/whisperfish/rust-phonenumber/commit/f69abee1481fac0d6d531407bae90020e39c6407\n","enisa_id":"EUVD-2024-2383\n","assigner":"GitHub_M","epss":0.71,"dataProcessed":"Oct 31, 2026, 7:13:10 AM","vulnerabilityProduct":[{"id":"11021ff4-afe9-4531-b9bf-0f284fe8fff7","product":{"name":"rust-phonenumber","vendor":{"name":"whisperfish"}},"product_version":"0.3.4, \u003c 0.3.6"},{"id":"9588d1be-7516-34b4-b2fa-eb440c37cd12","product":{"name":"rust-phonenumber","vendor":{"name":"whisperfish"}},"product_version":"0.3.4, \u003c 0.3.6"}],"vulnerabilityVendor":[{"id":"85cd65ed-1fe4-379d-859a-b3b2b82f902d","vendor":{"name":"whisperfish"}}]}}],"enisaIdAdvisory":[]}