Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

rusty-paseto

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Unratedcrates.ioPublished

    rusty_paseto vulnerable to private key extraction due to ed25519-dalek dependency

    GHSA-j57r-4qw6-58r3

    Affected
    • crates.io rusty-paseto <= 0.5.0
    Fixed in
    0.6.0· Vendor fix available
    Issue
    Impact The vulnerability, known as RUSTSEC-2022-0093, impacts the ed25519-dalek crate, which is a dependency of the rusty-paseto crate. This issue arises from a "Double Public Key Signing Function Oracle Attack" affecting versions of ed25519-dalek prior to v2.0. These versions expose an unsafe API for serializing and deserializing 64-byte keypairs that include both private and public keys, creating potential for certain attacks. d25519-dalek users utilizing these serialization and deserialization functions directly could potentially be impacted. Patches The vulnerability within the ed25519-dalek crate has been addressed in version 2.0. rusty-paseto has addressed it in release v0.6.0. Workarounds Users are recommended to upgrade to v0.6.0 of rusty-paseto. However, users should still ensure that their key serialization and deserialization practices are secure and avoid any practices that could lead to key exposure. References More information about RUSTSEC-2022-0093 can be found in the…

    Recommended action: Upgrade to 0.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →