Infinite Loop Vulnerability in Rust's Sequoia OpenPGP Library

CVE-2024-58261

What is CVE-2024-58261?

The sequoia-openpgp crate versions prior to 1.21.0 for Rust is susceptible to an infinite loop issue during RawCertParser operations. When an unsupported primary key type is encountered, the system generates a repeated error message, 'Reading a cert: Invalid operation: Not a Key packet.' This behavior can lead to application hangs, impacting the reliability and performance of Rust applications that utilize the sequoia-openpgp crate for cryptographic operations.

References