The OSTIF (Open Source Technology Improvement Fund) has published the results of a security audit of the Boost libraries, used in many C++ projects, with the aim of enhancing the security of open-source projects. The audit, commissioned by OSTIF and Amazon Web Services, was conducted by the Italian company Shielder and revealed 7 issues, one of which was assigned a medium severity level, while four received low severity levels, and two issues were published as informational notices.
Libraries assessed during the audit:
- Boost.Beast
- Boost.DLL
- Boost.Date_Time
- Boost.Filesystem
- Boost.GIL
- Boost.Graph
- Boost.JSON
- Boost.Program_Options
- Boost.Regex
- Boost.String_Algo
- Boost.URL
- Boost.UUID
Identified issues:
- A vulnerability in Boost.Beast allows the injection of carriage return and newline (CRLF) characters into HTTP headers (which can be used for header splitting). This issue has been assigned a medium severity level.
- Stack overflow in the Boost.Regex library during recursive execution of operations with multiple end_line elements in a regular expression.
- Stack overflow in the Boost.Regex library during recursive execution of operations with multiple capture groups and concatenation.
- Stack overflow in the Boost.Regex library during recursive execution of operations with multiple open parentheses in the formatting string.
- Stack overflow in the Boost.Graph library during recursive execution of operations with multiple nested graphs.
- Assert-trigger in the breadth_first_search function from the Boost.Graph library.
- Unhandled exceptions in Boost.DLL.
Based on the information obtained during the audit, the Boost development team has already resolved 4 issues and made 15 improvements to expand code coverage and functionality during fuzz testing. The header splitting issue in Boost.Beast and the informational recommendations have yet to be addressed.
Source: opennet.ru
