~ / search / GHSA-wrvc-72w7-xpmj

GHSA-wrvc-72w7-xpmj

Incorrect Comparison in sodiumoxide

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-25002

Packages

EcosystemPackageAffectedFixed in
crates.io sodiumoxide >= 0.2.0, < 0.2.5 0.2.5

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in the sodiumoxide crate starting with 0.2.0 and prior to 0.2.5 for Rust. `generichash::Digest::eq` compares itself to itself and thus has degenerate security properties.

References

External links from the advisory. They lead to third-party sites.