CyberRota Analysis
AI-GeneratedA double-free vulnerability exists in the handling of RSA public keys when BoringSSL fails to decode DER or PEM formatted bytes, potentially leading to application crashes during subsequent memory allocations. This issue affects unspecified products utilizing BoringSSL and should be prioritized by developers and organizations using swift-crypto versions prior to 4.5.1 to mitigate the risk of instability in their applications.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes provided. This vulnerability is addressed in swift-crypto version 4.5.1.