{"id":"CVE-2024-21530","aliases":["EUVD-2024-3124","GHSA-6878-6wc2-pf5h","GHSA-r2jw-c95q-rj29","RUSTSEC-2023-0068"],"status":"published","title":"Sequential calls of encryption API (`encrypt`, `wrap`, and `dump`) result in nonce reuse","description":"Versions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump functions are sequentially called. An attacker can generate the same ciphertext by creating a new encrypted message with the same cocoon object.\r\r**Note:**\rThe issue does NOT affect objects created with Cocoon::new which utilizes ThreadRng.","severity":{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0014,"percentile":0.03451,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-323"],"published":"2023-10-15T12:00:00Z","modified":"2026-10-28T02:31:14Z","fixes":[{"ecosystem":"crates.io","package":"cocoon","fixed_in":["0.4.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"cocoon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"cocoon","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"cocoon","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.4.0"}]}]}],"products":[{"vendor":"cocoon","product":"cocoon"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-RUST-COCOON-6028364","tags":["web"]},{"url":"https://github.com/fadeevab/cocoon/issues/22","tags":["report","web"]},{"url":"https://github.com/fadeevab/cocoon/commit/1b6392173ce35db4736a94b62b2d2973f9a71441","tags":["fix","web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0068.html","tags":["advisory","web"]},{"url":"https://github.com/advisories/GHSA-6878-6wc2-pf5h","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21530","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r2jw-c95q-rj29"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21530.json","tags":["advisory"]},{"url":"https://github.com/fadeevab/cocoon/commit","tags":["package"]},{"url":"https://github.com/fadeevab/cocoon","tags":["package"]},{"url":"https://crates.io/crates/cocoon","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-21530","description":"Versions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump functions are sequentially called. An attacker can generate the same ciphertext by creating a new encrypted message with the same cocoon object.\r\r**Note:**\rThe issue does NOT affect objects created with Cocoon::new which utilizes ThreadRng.","status":"published","published":"2024-10-02T05:00:02.359Z","modified":"2024-10-02T13:42:12.774Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:P","level":"medium","assessor":"cna"}],"cwes":["CWE-323"],"updated_at":"2026-11-02T14:34:05.077718Z"}],"euvd":[{"id":"EUVD-2024-3124","description":"Versions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump functions are sequentially called. An attacker can generate the same ciphertext by creating a new encrypted message with the same cocoon object.\r\r**Note:**\rThe issue does NOT affect objects created with Cocoon::new which utilizes ThreadRng.","status":"published","published":"2024-10-02T05:00:02Z","modified":"2024-10-02T13:42:12Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:P","level":"medium"}],"updated_at":"2026-11-03T00:27:59.473662Z"}],"ghsa":[{"id":"GHSA-6878-6wc2-pf5h","title":"Sequential calls of encryption API (`encrypt`, `wrap`, and `dump`) result in nonce reuse","description":"**Problem**: Trying to create a new encrypted message with the same cocoon object generates the same ciphertext. It mostly affects `MiniCocoon` and `Cocoon` objects with custom seeds and RNGs (where `StdRng` is used under the hood).\n\n**Note**: The issue does **NOT** affect objects created with **`Cocoon::new`** which utilizes `ThreadRng`.\n\n**Cause**: `StdRng` produces the same nonce because `StdRng::clone` resets its state.\n\n**Measure**: Make encryption API mutable (`encrypt`, `wrap`, and `dump`).\n\n**Workaround**: Create a new cocoon object with a new **seed** per each encryption.\n\n## How to Reproduce\n\n```rust\nlet cocoon = MiniCocoon::from_password(b\"password\", \u0026[1; 32]);\nlet mut data1 = \"my secret data\".to_owned().into_bytes();\nlet _ = cocoon.encrypt(\u0026mut data1)?;\n\nlet mut data2 = \"my secret data\".to_owned().into_bytes();\nlet _ = cocoon.encrypt(\u0026mut data2)?;\n\n// data1: [23, 217, 251, 151, 179, 62, 85, 15, 253, 92, 192, 112, 200, 52]\n// data2: [23, 217, 251, 151, 179, 62, 85, 15, 253, 92, 192, 112, 200, 52]\n```\n\n## Workaround\n\nFor `cocoon \u003c= 0.3.3`, create a new cocoon with a different **seed** per each `encrypt`/`wrap`/`dump` call.\n\n```rust\nlet cocoon = MiniCocoon::from_password(b\"password\", \u0026[1; 32]);\nlet mut data1 = \"my secret data\".to_owned().into_bytes();\nlet _ = cocoon.encrypt(\u0026mut data1)?;\n\n// Another seed: \u0026[2; 32].\nlet cocoon = MiniCocoon::from_password(b\"password\", \u0026[2; 32]);\nlet mut data2 = \"my secret data\".to_owned().into_bytes();\nlet _ = cocoon.encrypt(\u0026mut data2)?;\n\n// data1: [23, 217, 251, 151, 179, 62, 85, 15, 253, 92, 192, 112, 200, 52]\n// data2: [53, 223, 209, 96, 130, 99, 209, 108, 83, 189, 123, 81, 19, 1]\n```","status":"published","published":"2023-10-24T19:22:26Z","modified":"2025-12-29T22:23:47Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T14:39:15.106458Z"},{"id":"GHSA-r2jw-c95q-rj29","title":"Duplicate Advisory: cocoon Reuses a Nonce, Key Pair in Encryption","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-6878-6wc2-pf5h. This link is maintained to preserve external references.\n\n### Original Description\nVersions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump functions are sequentially called. An attacker can generate the same ciphertext by creating a new encrypted message with the same cocoon object.\n\n**Note:**\nThe issue does NOT affect objects created with Cocoon::new which utilizes ThreadRng.","status":"withdrawn","published":"2024-10-02T06:30:26Z","modified":"2025-12-29T22:23:37Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"},{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-323"],"updated_at":"2026-11-02T14:39:15.106458Z"}],"nvd":[{"id":"CVE-2024-21530","description":"Versions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump functions are sequentially called. An attacker can generate the same ciphertext by creating a new encrypted message with the same cocoon object.\r\r**Note:**\rThe issue does NOT affect objects created with Cocoon::new which utilizes ThreadRng.","status":"published","published":"2024-10-02T05:15:11.3Z","modified":"2026-06-17T07:09:41.23Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-323"],"updated_at":"2026-11-02T14:10:30.673028Z"}],"osv":[{"id":"CVE-2024-21530","description":"Versions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump functions are sequentially called. An attacker can generate the same ciphertext by creating a new encrypted message with the same cocoon object.\r\r**Note:**\rThe issue does NOT affect objects created with Cocoon::new which utilizes ThreadRng.","status":"published","published":"2024-10-02T05:00:02.359Z","modified":"2026-10-28T02:31:14.234437764Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:P","level":"medium"}],"cwes":["CWE-323"],"updated_at":"2026-11-02T15:44:38.577405Z"},{"id":"GHSA-6878-6wc2-pf5h","title":"Sequential calls of encryption API (`encrypt`, `wrap`, and `dump`) result in nonce reuse","description":"**Problem**: Trying to create a new encrypted message with the same cocoon object generates the same ciphertext. It mostly affects `MiniCocoon` and `Cocoon` objects with custom seeds and RNGs (where `StdRng` is used under the hood).\n\n**Note**: The issue does **NOT** affect objects created with **`Cocoon::new`** which utilizes `ThreadRng`.\n\n**Cause**: `StdRng` produces the same nonce because `StdRng::clone` resets its state.\n\n**Measure**: Make encryption API mutable (`encrypt`, `wrap`, and `dump`).\n\n**Workaround**: Create a new cocoon object with a new **seed** per each encryption.\n\n## How to Reproduce\n\n```rust\nlet cocoon = MiniCocoon::from_password(b\"password\", \u0026[1; 32]);\nlet mut data1 = \"my secret data\".to_owned().into_bytes();\nlet _ = cocoon.encrypt(\u0026mut data1)?;\n\nlet mut data2 = \"my secret data\".to_owned().into_bytes();\nlet _ = cocoon.encrypt(\u0026mut data2)?;\n\n// data1: [23, 217, 251, 151, 179, 62, 85, 15, 253, 92, 192, 112, 200, 52]\n// data2: [23, 217, 251, 151, 179, 62, 85, 15, 253, 92, 192, 112, 200, 52]\n```\n\n## Workaround\n\nFor `cocoon \u003c= 0.3.3`, create a new cocoon with a different **seed** per each `encrypt`/`wrap`/`dump` call.\n\n```rust\nlet cocoon = MiniCocoon::from_password(b\"password\", \u0026[1; 32]);\nlet mut data1 = \"my secret data\".to_owned().into_bytes();\nlet _ = cocoon.encrypt(\u0026mut data1)?;\n\n// Another seed: \u0026[2; 32].\nlet cocoon = MiniCocoon::from_password(b\"password\", \u0026[2; 32]);\nlet mut data2 = \"my secret data\".to_owned().into_bytes();\nlet _ = cocoon.encrypt(\u0026mut data2)?;\n\n// data1: [23, 217, 251, 151, 179, 62, 85, 15, 253, 92, 192, 112, 200, 52]\n// data2: [53, 223, 209, 96, 130, 99, 209, 108, 83, 189, 123, 81, 19, 1]\n```","status":"published","published":"2023-10-24T19:22:26Z","modified":"2025-12-29T22:29:24.519932Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"GHSA-r2jw-c95q-rj29","title":"Duplicate Advisory: cocoon Reuses a Nonce, Key Pair in Encryption","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-6878-6wc2-pf5h. This link is maintained to preserve external references.\n\n### Original Description\nVersions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump functions are sequentially called. An attacker can generate the same ciphertext by creating a new encrypted message with the same cocoon object.\n\n**Note:**\nThe issue does NOT affect objects created with Cocoon::new which utilizes ThreadRng.","status":"withdrawn","published":"2024-10-02T06:30:26Z","modified":"2025-12-29T22:29:44.035578Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-323"],"updated_at":"2026-11-02T15:46:55.122811Z"},{"id":"RUSTSEC-2023-0068","title":"Sequential calls of encryption API (`encrypt`, `wrap`, and `dump`) result in nonce reuse","description":"**Problem**: Trying to create a new encrypted message with the same cocoon\nobject generates the same ciphertext. It mostly affects `MiniCocoon` and\n`Cocoon` objects with custom seeds and RNGs (where `StdRng` is used under\nthe hood).\n\n**Note**: The issue does **NOT** affect objects created with **`Cocoon::new`**\nwhich utilizes `ThreadRng`.\n\n**Cause**: `StdRng` produces the same nonce because `StdRng::clone` resets its\nstate.\n\n**Measure**: Make encryption API mutable (`encrypt`, `wrap`, and `dump`).\n\n**Workaround**: Create a new cocoon object with a new **seed** per each\nencryption.\n\n## How to Reproduce\n\n```rust\nlet cocoon = MiniCocoon::from_password(b\"password\", \u0026[1; 32]);\nlet mut data1 = \"my secret data\".to_owned().into_bytes();\nlet _ = cocoon.encrypt(\u0026mut data1)?;\n\nlet mut data2 = \"my secret data\".to_owned().into_bytes();\nlet _ = cocoon.encrypt(\u0026mut data2)?;\n\n// data1: [23, 217, 251, 151, 179, 62, 85, 15, 253, 92, 192, 112, 200, 52]\n// data2: [23, 217, 251, 151, 179, 62, 85, 15, 253, 92, 192, 112, 200, 52]\n```\n\n## Workaround\n\nFor `cocoon \u003c= 0.3.3`, create a new cocoon with a different **seed**\nper each `encrypt`/`wrap`/`dump` call.\n\n```rust\nlet cocoon = MiniCocoon::from_password(b\"password\", \u0026[1; 32]);\nlet mut data1 = \"my secret data\".to_owned().into_bytes();\nlet _ = cocoon.encrypt(\u0026mut data1)?;\n\n// Another seed: \u0026[2; 32].\nlet cocoon = MiniCocoon::from_password(b\"password\", \u0026[2; 32]);\nlet mut data2 = \"my secret data\".to_owned().into_bytes();\nlet _ = cocoon.encrypt(\u0026mut data2)?;\n\n// data1: [23, 217, 251, 151, 179, 62, 85, 15, 253, 92, 192, 112, 200, 52]\n// data2: [53, 223, 209, 96, 130, 99, 209, 108, 83, 189, 123, 81, 19, 1]\n```","status":"published","published":"2023-10-15T12:00:00Z","modified":"2025-10-28T06:02:18Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:39.971022Z"}]}}