HIGH
GHSA-pmcv-mgcf-rvxg
Non-aligned u32 read in Chacha20 encryption and decryption
Details
The implementation does not enforce alignment requirements on input slices while incorrectly assuming 4-byte alignment through an unsafe call to `std::slice::from_raw_parts_mut`, which breaks the contract and introduces undefined behavior.
This affects Chacha20 encryption and decryption in crypto2.
Are you affected?
Enter the version of the package you're using.
Affected packages
crates.io/crypto2
Introduced in:
0No fixed version published yet for crypto2. Pin to a known-safe version or switch to an alternative.