VDB
Sign up
LOW

GHSA-9c48-w39g-hm26

rsa crate has potential panic on a prime being equal to 1

Details

When creating a RSA private key from its components, the construction panics, instead of returning an error, when one of the primes is `1`.

Discovered by Christian Reitter from [Radically Open Security](https://www.radicallyopensecurity.com/) during a security review for [Proton AG](https://proton.me/).

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/rsa
Introduced in: 0Fixed in: 0.9.10

Upgrade rsa to 0.9.10 or newer (ecosystem crates.io).

References