HIGH
GHSA-pv9v-5j35-xwcr
libcrux Panics During Standalone MAC Operations
Details
An incorrect constant for the key length in libcrux-poly1305 caused the standalone MAC function `libcrux_poly1305::mac` to always panic with an out-of-bounds memory access.
## Impact Applications wishing to use libcrux-poly1305 as a standalone MAC would experience panics. The use of libcrux-poly1305 in libcrux-chacha20poly1305 is unaffected.
## Mitigation Starting from version `0.0.5`, the correct value is used for the key length constant.
Are you affected?
Enter the version of the package you're using.
Affected packages
crates.io/libcrux-poly1305
Introduced in:
0Fixed in: 0.0.5Upgrade libcrux-poly1305 to 0.0.5 or newer (ecosystem crates.io).