Description
Versions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump functions are sequentially called. An attacker can generate the same ciphertext by creating a new encrypted message with the same cocoon object.
**Note:**
The issue does NOT affect objects created with Cocoon::new which utilizes ThreadRng.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | cocoon | < 0.4.0 | 0.4.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | cocoon | < 0.4.0 | 0.4.0 | GHSA-6878-6wc2-pf5h |
| crates.io | cocoon | >= 0.0.0-0, < 0.4.0 | 0.4.0 | RUSTSEC-2023-0068 |