GHSA-9hfg-pxr6-q4vpCriticalCVSS 9.8

Use of a Broken or Risky Cryptographic Algorithm in crypto2

Published
January 6, 2022
Last Modified
August 17, 2023

🔗 CVE IDs covered (1)

📋 Description

The implementation does not enforce alignment requirements on input slices while incorrectly assuming 4-byte alignment through an unsafe call to std::slice::from_raw_parts_mut, which breaks the contract and introduces undefined behavior.

This affects Chacha20 encryption and decryption in crypto2.

🎯 Affected products1

  • rust/crypto2:<= 0.1.2

🔗 References (5)