GHSA-j57r-4qw6-58r3

Source

https://github.com/advisories/GHSA-j57r-4qw6-58r3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-j57r-4qw6-58r3/GHSA-j57r-4qw6-58r3.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-j57r-4qw6-58r3

Published

2023-11-07T23:44:25Z

Modified

2023-11-07T23:44:25Z

Summary

rusty_paseto vulnerable to private key extraction due to ed25519-dalek dependency

Details

Impact

The vulnerability, known as RUSTSEC-2022-0093, impacts the ed25519-dalek crate, which is a dependency of the rusty-paseto crate. This issue arises from a "Double Public Key Signing Function Oracle Attack" affecting versions of ed25519-dalek prior to v2.0. These versions expose an unsafe API for serializing and deserializing 64-byte keypairs that include both private and public keys, creating potential for certain attacks. d25519-dalek users utilizing these serialization and deserialization functions directly could potentially be impacted.

Patches

The vulnerability within the ed25519-dalek crate has been addressed in version 2.0. rusty-paseto has addressed it in release v0.6.0.

Workarounds

Users are recommended to upgrade to v0.6.0 of rusty-paseto. However, users should still ensure that their key serialization and deserialization practices are secure and avoid any practices that could lead to key exposure.

References

More information about RUSTSEC-2022-0093 can be found in the RustSec Advisory Database. Updates and details regarding the upcoming release of rusty-paseto will be documented in the project's releases and changelog. This issue was first reported by Dependabot on 2023-08-15. The source was reviewed by @rrrodzilla at that time and a determination was made that the vulnerability low harm to existing users due to the strongly typed nature of keys provided by the rusty-paseto API. @techport-om reported the vulnerability to the repository by discovering during a cargo-audit run on 2023-11-05 and opened issue 28. This advisory was created at that time to notify existing users.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2023-11-07T23:44:25Z"
}

References

Affected packages

crates.io / rusty-paseto

Package

Name: rusty-paseto; View open source insights on deps.dev
Purl: pkg:cargo/rusty-paseto

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.6.0

Database specific

{
    "last_known_affected_version_range": "<= 0.5.0"
}