RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing various elliptic curve forms, scalars, points, and public/secret keys composed thereof. In versions 0.14.0-pre.0 and 0.14.0-rc.0, a denial-of-service vulnerability exists in the SM2 public-key encryption (PKE) implementation: the decrypt() path performs unchecked slice::split_at operations on input buffers derived from untrusted ciphertext. An attacker can submit short/undersized ciphertext or carefully-crafted DER-encoded structures to trigger bounds-check panics (Rust unwinding) which crash the calling thread or process. This issue has been patched via commit e60e991.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HRustcrypto Sm2 Elliptic Curve
APPRustcrypto0.14.0
Related vulnerabilities
RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and ...
RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and ...
RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in...
RustCrypto/RSA is a portable RSA implementation in pure Rust. Due to a non-constant-time implementation, infor...
Crate `rsa` to implementacja RSA napisana w Rust. Przed wersją 0.9.10, podczas tworzenia prywatnego klucza RSA...