Miggo Logo
Miggo Vulnerability Database
→
GHSA-j57r-4qw6-58r3

GHSA-j57r-4qw6-58r3: rusty_paseto vulnerable to private key extraction due to ed25519-dalek dependency

N/A

CVSS Score

Basic Information

CVE ID
-
GHSA ID
GHSA-j57r-4qw6-58r3
EPSS Score
-
CWE
-
Published
11/7/2023
Updated
11/7/2023
KEV Status
No
Technology
TechnologyRust

Technical Details

CVSS Vector
-
Package NameEcosystemVulnerable VersionsFirst Patched Version
rusty-pasetorust<= 0.5.00.6.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from ed25519-dalek's pre-2.0 APIs for keypair serialization/deserialization. The commit diff shows replacements of Keypair/PublicKey usage with SigningKey/VerifyingKey from ed25519-dalek 2.0. The vulnerable functions are those handling cryptographic operations for V2/V4 public tokens, specifically where raw key bytes were processed using the old unsafe APIs. The high confidence comes from direct evidence in the diff showing migration from deprecated key handling methods to the safer 2.0 APIs.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

## Imp**t T** vuln*r**ility, known *s RUSTS**-****-****, imp**ts t** `*******-**l*k` *r*t*, w*i** is * **p*n**n*y o* t** `rusty-p*s*to` *r*t*. T*is issu* *ris*s *rom * "*ou*l* Pu*li* K*y Si*nin* *un*tion Or**l* *tt**k" *****tin* v*rsions o* `*******

Reasoning

T** vuln*r**ility st*ms *rom `*******-**l*k`'s pr*-*.* *PIs *or k*yp*ir s*ri*liz*tion/**s*ri*liz*tion. T** *ommit *i** s*ows r*pl***m*nts o* `K*yp*ir`/`Pu*li*K*y` us*** wit* `Si*nin*K*y`/`V*ri*yin*K*y` *rom `*******-**l*k` *.*. T** vuln*r**l* *un*tio