GHSA-j2r6-2m5c-vgh5

Counter overflow in chacha20

Source: GitHub Advisory Database (reviewed) High CVE-2019-25005

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	chacha20	< 0.2.3	0.2.3

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in the chacha20 crate before 0.2.3 for Rust. A ChaCha20 counter overflow makes it easier for attackers to determine plaintext.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-25005 advisory
https://github.com/RustCrypto/stream-ciphers/pull/64 web
https://github.com/RustCrypto/stream-ciphers/tree/master/chacha20 package
https://rustsec.org/advisories/RUSTSEC-2019-0029.html web