GitHub Advisoryadvisory · crates.io

GHSA-fc7x-2cmc-8j2g Incorrect hash in sha2

CRITICAL Published 2022-01-06 Modified 2023-06-13 Official page ↗
Aliases
CVE-2021-45696
Ecosystem
crates.io
Packages
sha2
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-327
Reviewed
2022-01-06

Affected packages

• crates.io sha2: >= 0.9.7, < 0.9.8 → fixed in 0.9.8

Description

The v0.9.7 release of the sha2 crate introduced a new AVX2-accelerated backend which was automatically enabled for all x86/x86_64 CPUs where AVX2 support was autodetected at runtime. This backend was buggy and would miscompute results for long messages (i.e. messages spanning multiple SHA blocks). The crate has since been yanked, but any users who upgraded to v0.9.7 should immediately upgrade to v0.9.8 and recompute any hashes which were previously computed by v0.9.7.

Related

Alias · CVE (1)

  • CVE-2021-45696 An issue was discovered in the sha2 crate 0.9.7 before 0.9.8 for Rust. vulnerability

Weakness · CWE (1)

  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness

References