PT-2019-14539 · Rust · Blake2

Publicado 2019-08-25 · Atualizado 2021-08-25 · CVE-2019-16143

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions blake2 crate versions prior to 0.8.1

Description An issue was discovered in the blake2 crate when used with HMAC, where the BLAKE2b and BLAKE2s algorithms produce incorrect results due to incorrect block sizes. Specifically, the block sizes used were half of the required sizes, with 32-bytes used instead of 64-bytes for BLAKE2s, and 64-bytes used instead of 128-bytes for BLAKE2b, causing them to miscompute the MacResult. This issue only impacts the usage of BLAKE2 with HMAC and does not affect Digest functionality.

Recommendations For blake2 crate versions prior to 0.8.1, update to version 0.8.1 to resolve the issue. As a temporary workaround, consider avoiding the use of BLAKE2b and BLAKE2s algorithms with HMAC until the update is applied.

Correção

Use of a Broken Cryptographic Algorithm

Enumeração de Fraquezas

CWE-327

Identificadores relacionados

CVE-2019-16143

GHSA-4X25-PVHW-5224

RUSTSEC-2019-0019

Produtos afetados

Blake2

Referências · 8

• https://github.com/RustCrypto/hashes/tree/master/blake2 · Nota
• https://github.com/RustCrypto/MACs/issues/19 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-16143 · Nota de Segurança
• https://rustsec.org/advisories/RUSTSEC-2019-0019.html · Nota
• https://crates.io/crates/blake2 · Nota
• https://osv.dev/vulnerability/CVE-2019-16143 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-4x25-pvhw-5224 · Aviso do Fabricante
• https://osv.dev/vulnerability/RUSTSEC-2019-0019 · Aviso do Fabricante