{"id":"GHSA-fq33-vmhv-48xh","aliases":["RUSTSEC-2023-0032"],"url":"https://o3.security/vulnerability/GHSA-fq33-vmhv-48xh","summary":"ntru-rs has unsound FFI: Wrong API usage causes write past allocated area","details":"The following usage causes undefined behavior.\n```rust\nlet kp: ntru::types::KeyPair = …;\nkp.get_public().export(Default::default())\n```\n\nWhen compiled with debug assertions, the code above will trigger a `attempt to subtract with overflow` panic before UB occurs.\nOther mistakes (e.g. using `EncParams` from a different key) may always trigger UB.\n\nLikely, older versions of this crate are also affected, but have not been tested.\n","published":"2023-04-07T19:23:49Z","modified":"2023-11-08T04:19:06.327800Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"ntru","fixedVersion":null}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/FrinkGlobal/ntru-rs/issues/8"},{"type":"PACKAGE","url":"https://github.com/FrinkGlobal/ntru-rs"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2023-0032.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2023-11-08T04:19:06.327800Z"}}