PT-2019-16422 · Rust · Chacha20 Crate

Publicado 2019-10-22 · Atualizado 2021-08-25 · CVE-2019-25005

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions chacha20 crate versions prior to 0.2.3

Description A ChaCha20 counter overflow issue makes it easier for attackers to determine plaintext. The ChaCha20 stream cipher can produce a maximum of 2^32 blocks before the 32-bit counter overflows. When this limit is exceeded, the keystream is duplicated, leading to failure modes similar to nonce reuse, which can expose the XOR of two plaintexts.

Recommendations For versions prior to 0.2.3, update to version 0.2.3 or later to resolve the issue, as this version now panics when the counter overflow occurs, preventing the exposure of the duplicated keystream.

Correção

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

CVE-2019-25005

GHSA-J2R6-2M5C-VGH5

RUSTSEC-2019-0029

Produtos afetados

Chacha20 Crate

Referências · 9

• https://github.com/RustCrypto/stream-ciphers/tree/master/chacha20 · Nota
• https://github.com/RustCrypto/stream-ciphers/pull/64 · Nota
• https://osv.dev/vulnerability/GHSA-j2r6-2m5c-vgh5 · Aviso do Fabricante
• https://t.me/cvenotify/8218 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-25005 · Nota de Segurança
• https://rustsec.org/advisories/RUSTSEC-2019-0029.html · Nota
• https://osv.dev/vulnerability/CVE-2019-25005 · Aviso do Fabricante
• https://osv.dev/vulnerability/RUSTSEC-2019-0029 · Aviso do Fabricante
• https://crates.io/crates/chacha20 · Nota