-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ring | rust | < 0.17.13 | 0.17.13 |
RustRustMiggo AIRoot Cause AnalysisThe vulnerability description states that a panic may be triggered when overflow checking is enabled in some AES functions. The provided commit ec2d3cf1d91f148c84e4806b4f0b3c98f6df3b38 directly addresses this issue. The patch modifies the increment_by_less_safe function within the Counter struct in src/aead/aes.rs. The change from old_value + increment_by.get() to old_value.wrapping_add(increment_by.get()) clearly indicates that the standard addition operator was causing an overflow panic under certain conditions, and wrapping_add was introduced as a mitigation. Therefore, ring::aead::aes::Counter::increment_by_less_safe is identified as the vulnerable function.
Ongoing coverage of React2Shell