CVE-2023-39914
Nlnetlabs Bcder ≤ 0.7.3
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2023-39914 is a high-severity Improper Handling of Undefined Values (CWE-232) vulnerability in Nlnetlabs Bcder. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 45th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-2446
Vulnerability Data
NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types…
more
that utilized delayed decoding.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper input validation and error handling for undefined values.
Integrity protections for data-at-rest commonly include structural consistency checks that prevent or detect the described weakness.
Integrity protections for data-in-transit commonly include structural consistency checks that prevent or detect the described weakness.
Integrity protections for data-in-use commonly include structural consistency checks that prevent or detect the described weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect missing handling of undefined values before release.
Secure development life cycle requires handling of invalid/undefined inputs during design and coding.
Application security requirements include validation of all parameters and handling of unsupported values.
Secure architecture principles mandate explicit handling of undefined or unsupported states.
Secure coding standards directly require defensive checks for undefined or unsupported parameter values.
Change management ensures structural consistency is preserved when modifications are introduced.