The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messages for RawCertParser operations that encounter an unsupported primary key type.
References
| Link | Resource |
|---|---|
| https://crates.io/crates/sequoia-openpgp | Product |
| https://gitlab.com/sequoia-pgp/sequoia/-/issues/1106 | Exploit |
| https://gitlab.com/sequoia-pgp/sequoia/-/issues/1106 | Exploit |
| https://rustsec.org/advisories/RUSTSEC-2024-0345.html | Third Party Advisory |
Configurations
History
06 Aug 2025, 20:59
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://gitlab.com/sequoia-pgp/sequoia/-/issues/1106 - Exploit | |
| References | () https://crates.io/crates/sequoia-openpgp - Product | |
| References | () https://rustsec.org/advisories/RUSTSEC-2024-0345.html - Third Party Advisory | |
| First Time |
Sequoia-pgp
Sequoia-pgp sequoia-openpgp |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CPE | cpe:2.3:a:sequoia-pgp:sequoia-openpgp:*:*:*:*:*:rust:*:* |
28 Jul 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
27 Jul 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-07-27 20:15
Updated : 2025-08-06 20:59
NVD link : CVE-2024-58261
Mitre link : CVE-2024-58261
JSON object : View
Products Affected
sequoia-pgp
- sequoia-openpgp
CWE
No CWE.