Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Vulnerable library blake2 version 1.2 #4

Open
beta-vulnerability-notify bot opened this issue Sep 19, 2019 · 0 comments
Open

Vulnerable library blake2 version 1.2 #4

beta-vulnerability-notify bot opened this issue Sep 19, 2019 · 0 comments

Comments

@beta-vulnerability-notify
Copy link

A vulnerability has been found in the library blake2.

The description is:
Description When used in conjunction with the Hash-based Message Authentication Code (HMAC), the BLAKE2b and BLAKE2s implementations in blake2 crate versions prior to v0.8.1 used an incorrect block size (32-bytes instead of 64-bytes for BLAKE2s, and 64-bytes instead of 128-bytes for BLAKE2b), causing them to miscompute the MacResult. The v0.8.1 release of the blake2 crate uses the correct block sizes. Note that this advisory only impacts usage of BLAKE2 with HMAC, and does not impact Digest functionality. More Info RustCrypto/MACs#19 Patched Versions >= 0.8.1

Please fix this as soon as possible
Link to read more about the vulnerability:
https://watchers.firosolutions.com/vuln/view/RUSTSEC-2019-0019: blake2: HMAC-BLAKE2 algorithms compute incorrect results

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

0 participants