Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

hpke-rs

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.2crates.ioPublished

    Bug fixes in hpke-rs, hpke-rs-rust-crypto

    GHSA-g433-pq76-6cmf

    Affected
    • crates.io hpke-rs < 0.6.0
    Fixed in
    0.6.0· Vendor fix available
    Issue
    We publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the hpke-rs and hpke-rs-rust-crypto crates contain the following bug-fixes: hpke-rs - #127: Fix KemAlgorithm::TryFrom<u16 mapping where 0x004D incorrectly resolved to XWingDraft06 instead of XWingDraft06Obsolete. - #123: Fix potential overflow in context counter and switch to use u64. - #128: Return errors when trying to use open/seal with export only ciphersuite and when using kdf export with an output that's too long (instead of truncating it) The issue fixed in #123 was first reported by Nadim Kobeissi. The issues fixed in #127 and #128 were first reported by Scott Arciszewski. hpke-rs-rust-crypto - #124: Error out on x25519 0 keys The issue fixed in #124 was first reported by Nadim Kobeissi.

    Recommended action: Upgrade to 0.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →