Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1wbWN2LW1nY2YtcnZ4Z84AArrB

Non-aligned u32 read in Chacha20 encryption and decryption

The implementation does not enforce alignment requirements on input slices while incorrectly assuming 4-byte alignment through an unsafe call to std::slice::from_raw_parts_mut, which breaks the contract and introduces undefined behavior.

This affects Chacha20 encryption and decryption in crypto2.

Permalink: https://github.com/advisories/GHSA-pmcv-mgcf-rvxg
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wbWN2LW1nY2YtcnZ4Z84AArrB
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 2 years ago
Updated: about 1 year ago

Identifiers: GHSA-pmcv-mgcf-rvxg
References:

• https://github.com/shadowsocks/crypto2/issues/27
• https://rustsec.org/advisories/RUSTSEC-2021-0121.html
• https://github.com/advisories/GHSA-pmcv-mgcf-rvxg

Repository: https://github.com/shadowsocks/crypto2
Blast Radius: 0.0

Affected Packages