Publish GHSA-2hfw-w739-p7x5

2026-05-22 18:04:22 -07:00 · 2024-06-04 17:50:43 +00:00
parent da6fc85e83
commit 25a2629f57
1 changed files with 61 additions and 0 deletions
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2hfw-w739-p7x5",
+  "modified": "2024-06-04T17:49:18Z",
+  "published": "2024-06-04T17:49:18Z",
+  "aliases": [
+
+  ],
+  "summary": "nano-id reduced entropy due to inadequate character set usage",
+  "details": "## Description\n\nAffected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the `nano_id::base62` and `nano_id::base58` functions. Specifically, the `base62` function used a character set of 32 symbols instead of the intended 62 symbols, and the `base58` function used a character set of 16 symbols instead of the intended 58 symbols. Additionally, the `nano_id::gen` macro is also affected when a custom character set that is not a power of 2 in size is specified.\n\nIt should be noted that `nano_id::base64` is not affected by this vulnerability.\n\n## Impact\n\nThis can result in a significant reduction in entropy, making the generated IDs predictable and vulnerable to brute-force attacks when the IDs are used in security-sensitive contexts such as session tokens or unique identifiers.\n\n## Patches\n\nThe flaws were corrected in commit [a9022772b2f1ce38929b5b81eccc670ac9d3ab23](https://github.com/viz-rs/nano-id/commit/a9022772b2f1ce38929b5b81eccc670ac9d3ab23) by updating the the `nano_id::gen` macro to use all specified characters correctly.\n\n## PoC\n\n```rust\nuse std::collections::BTreeSet;\n\nfn main() {\n    test_base58();\n    test_base62();\n}\n\nfn test_base58() {\n    let mut produced_symbols = BTreeSet::new();\n\n    for _ in 0..100_000 {\nid = \"RUSTSEC-2024-0343\"\n        for c in id.chars() {\n            produced_symbols.insert(c);\n        }\n    }\n\n    println!(\n        \"{} symbols generated from nano_id::base58\",\n        produced_symbols.len()\n    );\n}\n\nfn test_base62() {\n    let mut produced_symbols = BTreeSet::new();\n\n    for _ in 0..100_000 {\nid = \"RUSTSEC-2024-0343\"\n        for c in id.chars() {\n            produced_symbols.insert(c);\n        }\n    }\n\n    println!(\n        \"{} symbols generated from nano_id::base62\",\n        produced_symbols.len()\n    );\n}\n```\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "nano-id"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.4.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/viz-rs/nano-id/commit/a9022772b2f1ce38929b5b81eccc670ac9d3ab23"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/viz-rs/nano-id"
+    },
+    {
+      "type": "WEB",
+      "url": "https://rustsec.org/advisories/RUSTSEC-2024-0343.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-331"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-06-04T17:49:18Z",
+    "nvd_published_at": null
+  }
+}