CVE-2019-25005 Counter overflow in chacha20
A counter overflow in the chacha20 Rust library allows attackers to more easily determine plaintext, compromising data confidentiality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-25005?
CVE-2019-25005 is a high-severity vulnerability in n/a, published on 31 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the chacha20 crate before 0.2.3 for Rust. A ChaCha20 counter overflow makes it easier for attackers to determine plaintext.
Weakness: CWE-190
Which versions are affected by CVE-2019-25005?
3 open source packages ship an affected version, including chacha20. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
chacha20 crates.io | All versions | 0.2.3 |
chacha20 crates.io | All versions | 0.2.3 |
chacha20 crates.io | From 0.0.0-0 | 0.2.3 |
Products include Chacha20 Project Chacha20.
How do I fix CVE-2019-25005?
Upgrade chacha20 to 0.2.3 or later.
Is CVE-2019-25005 being exploited?
There is no known exploitation of CVE-2019-25005 in the wild and no public exploit code.
Sources
Also known as GHSA-j2r6-2m5c-vgh5, RUSTSEC-2019-0029.