CVE-2023-53160

The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic.

CVSS v3 2.9 LOW

2.9^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.4 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://crates.io/crates/sequoia-openpgp	Product
https://github.com/advisories/GHSA-25mx-8f3v-8wh7	Third Party Advisory
https://lists.sequoia-pgp.org/hyperkitty/list/announce@lists.sequoia-pgp.org/thread/SN2E3QRT4DMQ5JNEK6VIN6DJ5SH766DI/	Patch
https://rustsec.org/advisories/RUSTSEC-2023-0038.html	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sequoia-pgp:sequoia-openpgp::::::rust::*
	cpe:2.3:a:sequoia-pgp:sequoia-openpgp::::::rust::*
	cpe:2.3:a:sequoia-pgp:sequoia-openpgp::::::rust::*

History

06 Aug 2025, 21:15

Type	Values Removed	Values Added
First Time		Sequoia-pgp Sequoia-pgp sequoia-openpgp
CPE		cpe:2.3:a:sequoia-pgp:sequoia-openpgp::::::rust::*
References	~~() https://crates.io/crates/sequoia-openpgp -~~	() https://crates.io/crates/sequoia-openpgp - Product
References	~~() https://github.com/advisories/GHSA-25mx-8f3v-8wh7 -~~	() https://github.com/advisories/GHSA-25mx-8f3v-8wh7 - Third Party Advisory
References	~~() https://lists.sequoia-pgp.org/hyperkitty/list/announce@lists.sequoia-pgp.org/thread/SN2E3QRT4DMQ5JNEK6VIN6DJ5SH766DI/ -~~	() https://lists.sequoia-pgp.org/hyperkitty/list/announce@lists.sequoia-pgp.org/thread/SN2E3QRT4DMQ5JNEK6VIN6DJ5SH766DI/ - Patch
References	~~() https://rustsec.org/advisories/RUSTSEC-2023-0038.html -~~	() https://rustsec.org/advisories/RUSTSEC-2023-0038.html - Third Party Advisory

29 Jul 2025, 14:14

Type	Values Removed	Values Added
Summary		(es) El paquete sequoia-openpgp para Rust anterior a 1.16.0 permite el acceso a matrices fuera de los límites y un pánico.

28 Jul 2025, 03:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-28 03:15

Updated : 2025-08-06 21:15

NVD link : CVE-2023-53160

Mitre link : CVE-2023-53160

CVE.ORG link : CVE-2023-53160

JSON object : View

Products Affected

sequoia-pgp

sequoia-openpgp

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2023-53160", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.9, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.4}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2025-07-28T03:15:23.373", "references": [{"url": "https://crates.io/crates/sequoia-openpgp", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/advisories/GHSA-25mx-8f3v-8wh7", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://lists.sequoia-pgp.org/hyperkitty/list/announce@lists.sequoia-pgp.org/thread/SN2E3QRT4DMQ5JNEK6VIN6DJ5SH766DI/", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://rustsec.org/advisories/RUSTSEC-2023-0038.html", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic."}, {"lang": "es", "value": "El paquete sequoia-openpgp para Rust anterior a 1.16.0 permite el acceso a matrices fuera de los l\u00edmites y un p\u00e1nico."}], "lastModified": "2025-08-06T21:15:47.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sequoia-pgp:sequoia-openpgp:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "899EAF37-6EF6-49B0-AE10-38533DABC70C", "versionEndExcluding": "1.1.1"}, {"criteria": "cpe:2.3:a:sequoia-pgp:sequoia-openpgp:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "AD15C962-C5C6-4FBF-BE9F-635A85B4617B", "versionEndExcluding": "1.8.1", "versionStartIncluding": "1.2.0"}, {"criteria": "cpe:2.3:a:sequoia-pgp:sequoia-openpgp:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "669DC8B7-70D0-462F-9FA7-3DFACD9B7D3D", "versionEndExcluding": "1.16.0", "versionStartIncluding": "1.9.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}