How severe is GHSA-j57r-4qw6-58r3?

No CVSS score has been assigned to GHSA-j57r-4qw6-58r3 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-j57r-4qw6-58r3?

GHSA-j57r-4qw6-58r3 affects the following packages: rusty-paseto (crates.io). Ecosystems affected: crates.io.

How do I fix GHSA-j57r-4qw6-58r3?

Update rusty-paseto to 0.6.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-j57r-4qw6-58r3 is resolved across your whole dependency graph.

How do I detect GHSA-j57r-4qw6-58r3 in my crates.io dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for rusty-paseto, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-j57r-4qw6-58r3 if there is no patch (or I can't update yet)?

Do not deserialise data from untrusted sources: where the format allows it, restrict deserialisation to an explicit allowlist of expected types, and prefer a data-only format (JSON, Protobuf) over one that can reconstruct arbitrary objects until you can upgrade.

Is GHSA-j57r-4qw6-58r3 actively exploited in the wild?

No public exploit code has been indexed for GHSA-j57r-4qw6-58r3 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-j57r-4qw6-58r3 published, and has it been updated?

GHSA-j57r-4qw6-58r3 was published on November 7, 2023. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🦀 crates.io

Not in CISA KEV

rusty_paseto vulnerable to private key extraction due to ed25519-dalek dependencyGHSA-j57r-4qw6-58r3

Fix: rrrodzilla/rusty_paseto@42718c1

GHSA-j57r-4qw6-58r3 is a remote code execution vulnerability in rusty-paseto. A fix is available for rusty-paseto — see the affected versions and patch details below.

Published

Nov 7, 2023

Updated

Nov 7, 2023

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Nov 7, 2023 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

🦀rusty-paseto

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.

Description

Impact

The vulnerability, known as RUSTSEC-2022-0093, impacts the ed25519-dalek crate, which is a dependency of the rusty-paseto crate. This issue arises from a "Double Public Key Signing Function Oracle Attack" affecting versions of ed25519-dalek prior to v2.0. These versions expose an unsafe API for serializing and deserializing 64-byte keypairs that include both private and public keys, creating potential for certain attacks. d25519-dalek users utilizing these serialization and deserialization functions directly could potentially be impacted.

Patches

The vulnerability within the ed25519-dalek crate has been addressed in version 2.0. rusty-paseto has addressed it in release v0.6.0.

Workarounds

Users are recommended to upgrade to v0.6.0 of rusty-paseto. However, users should still ensure that their key serialization and deserialization practices are secure and avoid any practices that could lead to key exposure.

References

More information about RUSTSEC-2022-0093 can be found in the RustSec Advisory Database. Updates and details regarding the upcoming release of rusty-paseto will be documented in the project's releases and changelog. This issue was first reported by Dependabot on 2023-08-15. The source was reviewed by @rrrodzilla at that time and a determination was made that the vulnerability low harm to existing users due to the strongly typed nature of keys provided by the rusty-paseto API. @techport-om reported the vulnerability to the repository by discovering during a cargo-audit run on 2023-11-05 and opened issue 28. This advisory was created at that time to notify existing users.

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🦀crates.io	`rusty-paseto`	all versions	0.6.0`cargo update -p rusty-paseto --precise 0.6.0`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for rusty-paseto, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update rusty-paseto to 0.6.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-j57r-4qw6-58r3 is resolved across your whole dependency graph.
Workarounds
Do not deserialise data from untrusted sources: where the format allows it, restrict deserialisation to an explicit allowlist of expected types, and prefer a data-only format (JSON, Protobuf) over one that can reconstruct arbitrary objects until you can upgrade.

Frequently Asked Questions

## Impact The vulnerability, known as RUSTSEC-2022-0093, impacts the `ed25519-dalek` crate, which is a dependency of the `rusty-paseto` crate. This issue arises from a "Double Public Key Signing Function Oracle Attack" affecting versions of `ed25519-dalek` prior to v2.0. These versions expose an unsafe API for serializing and deserializing 64-byte keypairs that include both private and public keys, creating potential for certain attacks. `d25519-dalek` users utilizing these serialization and deserialization functions directly could potentially be impacted. ## Patches The vulnerability with

O3 Security · Impact-Aware SCA

Is GHSA-j57r-4qw6-58r3 in your dependencies?

Find it across crates.io, including transitive dependencies.

Scan my dependencies How O3 SCA works