GHSA-39wr-f4ff-xm6p

Incorrect implementation in streebog

Source: GitHub Advisory Database (reviewed) High CVE-2019-25007

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	streebog	< 0.8.0	0.8.0

Details

As written in the advisory (Markdown source, shown as plain text).

Internal update-sigma function was implemented incorrectly and depending on debug-assertions it could've caused an incorrect result or panic for certain inputs.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-25007 advisory
https://github.com/RustCrypto/hashes/pull/91 web
https://github.com/RustCrypto/hashes/tree/master/streebog package
https://rustsec.org/advisories/RUSTSEC-2019-0030.html web