GitHub Advisoryadvisory · crates.io

GHSA-9hfg-pxr6-q4vp Use of a Broken or Risky Cryptographic Algorithm in crypto2

CRITICAL Published 2022-01-06 Modified 2023-06-13 Official page ↗
Aliases
CVE-2021-45709
Ecosystem
crates.io
Packages
crypto2
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-119
Reviewed
2022-01-05

Affected packages

• crates.io crypto2: <= 0.1.2 (no fix yet)

Description

The implementation does not enforce alignment requirements on input slices while incorrectly assuming 4-byte alignment through an unsafe call to std::slice::from_raw_parts_mut, which breaks the contract and introduces undefined behavior. This affects Chacha20 encryption and decryption in crypto2.

Related

Alias · CVE (1)

  • CVE-2021-45709 An issue was discovered in the crypto2 crate through 2021-10-08 for Rust. vulnerability

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References