Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

snow

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 3.1crates.ioPublished

    Unauthenticated Nonce Increment in snow

    CVE-2024-58265 · GHSA-7g9j-g5jg-3vv3

    Affected
    • crates.io snow < 0.9.5
    Fixed in
    0.9.5· Vendor fix available
    Issue
    Impact There was a logic bug where unauthenticated payloads could still cause a nonce increment in snow's internal state. For an attacker with the ability to inject packets into the channel Noise is talking over, this allows a denial-of-service type attack which could prevent communication as it causes the sending and receiving side to be expecting different nonce values than would arrive. Note that this only affects those who are using the stateful TransportState, not those using StatelessTransportState. Patches This has been patched in version 0.9.5, and all users are recommended to update. References There will be a more formal report of this in the near future.

    Recommended action: Upgrade to 0.9.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →