Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWdmOTMtaDc5cS02amp2

Incorrect implementation of the Streebog hash functions in streebog

Internal update-sigma function was implemented incorrectly and depending on debug-assertions it could've caused an incorrect result or panic for certain inputs.

Permalink: https://github.com/advisories/GHSA-gf93-h79q-6jjv
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWdmOTMtaDc5cS02amp2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: 6 months ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-gf93-h79q-6jjv, CVE-2019-25006
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-25006
• https://github.com/RustCrypto/hashes/pull/91
• https://rustsec.org/advisories/RUSTSEC-2019-0030.html
• https://github.com/advisories/GHSA-gf93-h79q-6jjv

Repository: https://github.com/RustCrypto/hashes
Blast Radius: 11.5

Affected Packages