Skip to content
Fencer Intel
low —

GHSA-gmx7-gr5q-85w5 json

magic-crypt uses insecure cryptographic algorithms

published last yr. modified last yr. also RUSTSEC-2024-0430

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

This crate uses a number of cryptographic algorithms that are no longer considered secure and it uses them in ways that do not guarantee the integrity of the encrypted data.

`MagicCrypt64` uses the insecure DES block cipher in CBC mode without authentication. This allows for practical brute force and padding oracle attacks and does not protect the integrity of the encrypted data. Key and IV are generated from user input using CRC64, which is not at all a key derivation function.

`MagicCrypt64`, `MagicCrypt128`, `MagicCrypt192`, and `MagicCrypt256` are all vulnerable to padding-oracle attacks. None of them protect the integrity of the ciphertext. Furthermore, none use password-based key derivation functions, even though the key is intended to be generated from a password.

Each of the implementations are unsound in that they use uninitialized memory without `MaybeUninit` or equivalent structures.

For more information, visit the [issue](https://github.com/magiclen/rust-magiccrypt/issues/17).

Is GHSA-gmx7-gr5q-85w5 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io magic-crypt
<=4.0.1
>=0.0.0-0
 no fix listed

Classification

Weakness
  • CWE-326 Inadequate Encryption Strength

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.