rcrypto has a stack buffer overflow
Open
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 1.2k
- Forks
- 544
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 45
Description
https://github.com/mengsuenyan/rcrypto/issues/1
https://asan.saethlin.dev/ub?crate=rcrypto&version=0.2.0
Crate has no dependents: https://crates.io/crates/rcrypto/reverse_dependencies
Check in after a few months to see if there's any response. Probably needs an unmaintained advisory since it mentions cryptography
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked rcrypto issue and the ASAN report for version 0.2.0; verify what the reported stack buffer overflow affects and whether the crate is unmaintained. Done means determining the appropriate advisory treatment, including whether an unmaintained advisory is warranted, and documenting the evidence in the advisory database.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100