CVE catalog

CVE-2024-58261

rust-sequoia-openpgp: CVE-2024-58261

[CVE catalog]

Severity
Low · CVSS 2.9CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.40% · Oct 25, 2026

The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messages for RawCertParser operations that encounter an unsupported primary key type.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrust-sequoia-openpgpsid2.4.1-2fixed
Debianrust-sequoia-openpgpforky2.4.1-2fixed
Debianrust-sequoia-openpgptrixie2.0.0-2+deb13u1fixed
Debianrust-sequoia-openpgpbookworm1.12.0-2not affected
Ubunturust-sequoia-openpgp22.041.1.0-3vulnerable
Ubunturust-sequoia-openpgp22.041.3.0-4vulnerable
Ubunturust-sequoia-openpgp22.041.7.0-6vulnerable
Ubunturust-sequoia-openpgp24.041.16.0-1vulnerable
Ubunturust-sequoia-openpgp24.041.17.0-1vulnerable
Ubunturust-sequoia-openpgp24.041.17.0-2vulnerable
Ubunturust-sequoia-openpgp24.041.18.0-1vulnerable
Ubunturust-sequoia-openpgp24.041.19.0-1vulnerable
Ubunturust-sequoia-openpgp24.041.19.0-1build1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrust-sequoia-openpgpsourcesid1.21.0-1not yet assignedNot reported[1074352]
Debianrust-sequoia-openpgpsourceforky1.21.0-1not yet assignedNot reported[1074352]
Debianrust-sequoia-openpgpsourcetrixie1.21.0-1not yet assignedNot reported[1074352]
Debianrust-sequoia-openpgpsourcebookwormNot affectedunimportantNot reported[1074352]

[Debian bug #1074352]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[Debian 13 (Trixie)]

  • [librust-sequoia-openpgp-dev]Fixed

    Source package: [rust-sequoia-openpgp]

    Details (2)

    • 2.0.0-2+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1.21.0-1

      dsa · rust-sequoia-openpgp · debian · 13

    • 2.0.0-2+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1.21.0-1

      dsa · rust-sequoia-openpgp · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]