Lucene search
GoogleOSV:GHSA-FC7X-2CMC-8J2GHistoryJan 06, 2022 - 10:10 p.m.
Incorrect hash in sha2
2022-01-0622:10:26
Google
osv.dev
9
sha2
hash
bug
upgrade
EPSS
0.002
Percentile
62.1%
The v0.9.7 release of the sha2 crate introduced a new AVX2-accelerated backend which was automatically enabled for all x86/x86_64 CPUs where AVX2 support was autodetected at runtime.
This backend was buggy and would miscompute results for long messages (i.e. messages spanning multiple SHA blocks).
The crate has since been yanked, but any users who upgraded to v0.9.7 should immediately upgrade to v0.9.8 and recompute any hashes which were previously computed by v0.9.7.
Related
cvelist
cvelist
CVE-2021-45696
2021-12-26 21:50:03
osv
osv
Miscomputed results when using AVX2 backend
2021-09-08 12:00:00
Miscomputed sha2 results when using AVX2 backend
2022-06-17 00:19:35
cve
cve
CVE-2021-45696
2021-12-27 00:15:09
prion
prion
Design/Logic Flaw
2021-12-27 00:15:00
rustsec
rustsec
Miscomputed results when using AVX2 backend
2021-09-08 12:00:00
debiancve
debiancve
CVE-2021-45696
2021-12-27 00:15:09
cnvd
cnvd
Mozilla Rust has an unspecified vulnerability (CNVD-2022-03124)
2021-12-28 00:00:00
github
github
Incorrect hash in sha2
2022-01-06 22:10:26
nvd
nvd
CVE-2021-45696
2021-12-27 00:15:09