Skip to content
OpenAdvisories
Medium · 4.5 CVE-2024-21530 EUVD-2024-3124GHSA-6878-6wc2-pf5hGHSA-r2jw-c95q-rj29RUSTSEC-2023-0068

Sequential calls of encryption API (`encrypt`, `wrap`, and `dump`) result in nonce reuse

Published Oct 2, 2024 · Updated Oct 2, 2024 · Assigned by snyk

Description

Versions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump functions are sequentially called. An attacker can generate the same ciphertext by creating a new encrypted message with the same cocoon object.

**Note:**
The issue does NOT affect objects created with Cocoon::new which utilizes ThreadRng.

Affected products

VendorProductAffectedFixed
— cocoon < 0.4.0 0.4.0

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io cocoon < 0.4.0 0.4.0 GHSA-6878-6wc2-pf5h
crates.io cocoon >= 0.0.0-0, < 0.4.0 0.4.0 RUSTSEC-2023-0068

References