N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-g433-pq76-6cmf

GHSA-g433-pq76-6cmf: Bug fixes in hpke-rs, hpke-rs-rust-crypto

We publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the hpke-rs and hpke-rs-rust-crypto crates contain the following bug-fixes:

hpke-rs

#127: Fix KemAlgorithm::TryFrom<u16> mapping where 0x004D incorrectly resolved to XWingDraft06 instead of XWingDraft06Obsolete.
#123: Fix potential overflow in context counter and switch to use u64.
#128: Return errors when trying to use open/seal with export only ciphersuite and when using kdf export with an output that's too long (instead of truncating it)

The issue fixed in #123 was first reported by Nadim Kobeissi. The issues fixed in #127 and #128 were first reported by Scott Arciszewski.

hpke-rs-rust-crypto

#124: Error out on x25519 0 keys

The issue fixed in #124 was first reported by Nadim Kobeissi.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-g433-pq76-6cmf

GHSA-g433-pq76-6cmf:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hpke-rs	rust	< 0.6.0	0.6.0
hpke-rs-rust-crypto	rust	< 0.6.0	0.6.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patches reveals several distinct vulnerabilities across the hpke-rs and hpke-rs-rust-crypto crates. The root causes are improper input validation, integer overflows, and incorrect comparison logic.

Integer Overflow in Sequence Counter (PR #123): In src/lib.rs, the Context struct used a u32 for its sequence_number. The increment_sequence_number function would increment this counter without checking for overflow. In a long-lived context, an attacker could force this counter to wrap around, causing nonce reuse for the AEAD cipher in Context::seal and Context::open, which is a catastrophic failure of confidentiality and integrity. The fix was to change the counter to a u64 and use checked_add to prevent overflow.
Improper Input Validation for X25519 Keys (PR #124): In rust_crypto_provider/src/lib.rs, the HpkeRustCrypto::dh function for DhKem25519 did not validate if the resulting shared secret was an all-zero value. This can happen when a low-order public key is used. The patch adds a check to ensure the shared secret is not all-zeros, preventing a weak key attack.
Improper Input Validation in seal/open and KDF (PR #128):
- In src/lib.rs, the Context::seal and Context::open functions did not check if the ciphersuite was for 'export-only' mode. Calling these functions on such a context would lead to a panic due to an arithmetic underflow when calculating nonce length. The patch adds a check to return an error in this case.
- In src/kdf.rs, the labeled_expand function silently truncated the requested output len because it was cast from a usize to a u16 without proper bounds checking in release builds. This could lead to a significantly shorter key than requested. The fix introduces a proper check to ensure the length does not exceed u16::MAX.
Incorrect Comparison in KEM Algorithm Mapping (PR #127): In traits/src/types.rs, the TryFrom<u16> implementation for KemAlgorithm incorrectly mapped the value 0x004D to XWingDraft06 instead of XWingDraft06Obsolete. This would cause a mismatch in the selected key encapsulation mechanism, breaking protocol compatibility when that specific identifier was used.

These issues highlight a pattern of missing or incomplete validation of cryptographic parameters and state, which are critical for the security of a cryptographic library.

Vulnerable functions

hpke::Context::increment_sequence_number

src/lib.rs

The function incremented a 32-bit sequence number without checking for overflow. An attacker could potentially cause the counter to wrap around by performing a large number of encryption/decryption operations, leading to nonce reuse and a break in confidentiality and integrity.

hpke::Context::seal

src/lib.rs

This function was vulnerable in two ways. First, it relied on `increment_sequence_number`, making it susceptible to nonce reuse due to integer overflow. Second, when used with an export-only ciphersuite, it would cause an arithmetic underflow and panic because the nonce length is zero, which was not properly handled before the seal operation.

hpke::Context::open

src/lib.rs

hpke_rs_rust_crypto::HpkeRustCrypto::dh

rust_crypto_provider/src/lib.rs

The Diffie-Hellman function for X25519 did not check if the computed shared secret was the all-zero value. This can occur if a party uses a weak public key (e.g., a small-order point). An attacker could provide such a key, resulting in a predictable, zeroed-out shared secret, compromising the security of the key exchange.

hpke::kdf::labeled_expand

src/kdf.rs

The function used a `debug_assert` to validate the output length, which is stripped in release builds. In release mode, if a length greater than `u16::MAX` was provided, it would be silently truncated during a cast to `u16`. This would result in a much shorter (and incorrect) key being derived from the KDF, which could severely weaken the cryptographic operations that depend on it.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.