Skip to content

Possible DoS attack on Phelix encryption and decryption functions

Low
Jellix published GHSA-rhc2-jfvw-jvjf May 28, 2020

Package

No package listed

Affected versions

< 2.0.2

Patched versions

2.0.2

Description

Impact

Users of the code could have passed an empty array with bounds outside the defined range (e.g. < -2 ** 62 - 1, or > 2 ** 62 + 1). If runtime checks were enabled this would have caused a Constraint_Error being raised.
The likelihood of that happening by accident in normal code is rather low, data streams typically start at indices 0 or 1, and very unlikely define terabytes worth of memory, so even with array slicing such a value is rather hard to achieve in any practical scenario.

Patches

This has been patched in release 2.0.2.

Workarounds

As only zero length arrays can have such an index violating the range of the index type, checking in the calling code that the lower bound of the array is within the index type range should suffice.

Severity

Low

CVE ID

No known CVE

Weaknesses

No CWEs

Credits