Swift Crypto
Monthly
Denial of service in Apple's swift-crypto (all versions before 4.5.1) allows remote attackers to crash a process by supplying malformed RSA public key bytes. When BoringSSL fails to decode a DER- or PEM-encoded RSA public key, the underlying EVP_PKEY* is freed twice - once in the error catch block and again during deinitialization - corrupting the allocator and causing a crash on subsequent memory allocations. No public exploit identified at time of analysis; the flaw is memory-safety corruption limited to availability impact (CVSS 7.5).
Denial of service in Apple's swift-crypto (all versions before 4.5.1) allows remote attackers to crash a process by supplying malformed RSA public key bytes. When BoringSSL fails to decode a DER- or PEM-encoded RSA public key, the underlying EVP_PKEY* is freed twice - once in the error catch block and again during deinitialization - corrupting the allocator and causing a crash on subsequent memory allocations. No public exploit identified at time of analysis; the flaw is memory-safety corruption limited to availability impact (CVSS 7.5).