CVE-2025-0343 Details
Description
Swift ASN.1 can be caused to crash when parsing certain BER/DER constructions. This crash is caused by a confusion in the ASN.1 library itself which assumes that certain objects can only be provided in either constructed or primitive forms, and will trigger a preconditionFailure if that constraint isn't met. Importantly, these constraints are actually required to be true in DER, but that correctness wasn't enforced on the early node parser side so it was incorrect to rely on it later on in decoding, which is what the library did. These crashes can be triggered when parsing any DER/BER format object. There is no memory-safety issue here: the crash is a graceful one from the Swift runtime. The impact of this is that it can be used as a denial-of-service vector when parsing BER/DER data from unknown sources, e.g. when parsing TLS certificates.
A denial-of-service vulnerability has been identified in the Swift ASN.1 library, affecting versions prior to 1.3.0. The issue arises when the library parses certain BER/DER constructions, leading to a crash. This crash occurs because the library incorrectly assumes that specific objects can only be in either constructed or primitive forms, triggering a precondition failure when this assumption is violated. Although these constraints are mandatory in DER, the early node parser did not enforce them, allowing for this vulnerability to be exploited. The crash, while not a memory-safety issue, represents a graceful failure in the Swift runtime. This vulnerability can be exploited when parsing BER/DER data from untrusted sources, such as TLS certificates.
Users can upgrade to Swift ASN.1 version 1.3.1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jan 15, 2025CISA-ADP
Assessed Jan 15, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/apple/swift-asn1/security/advisories/GHSA-w8xv-rwgf-4fwh | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-228 | Improper Handling of Syntactically Invalid Structure | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| apple swift-asn1 | All versions |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 24, 2025 | CVE Modified | CISA-ADP |
| Feb 18, 2025 | CVE Modified | CISA-ADP |
| Jan 15, 2025 | CVE Modified | CISA-ADP |
| Jan 15, 2025 | New CVE Received | [email protected] |