{"id":"GHSA-fq33-vmhv-48xh","aliases":["RUSTSEC-2023-0032"],"status":"published","title":"ntru-rs has unsound FFI: Wrong API usage causes write past allocated area","description":"The following usage causes undefined behavior.\n```rust\nlet kp: ntru::types::KeyPair = …;\nkp.get_public().export(Default::default())\n```\n\nWhen compiled with debug assertions, the code above will trigger a `attempt to subtract with overflow` panic before UB occurs.\nOther mistakes (e.g. using `EncParams` from a different key) may always trigger UB.\n\nLikely, older versions of this crate are also affected, but have not been tested.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2023-03-22T12:00:00Z","modified":"2023-11-08T04:19:06Z","affected":[{"source":"ghsa","ecosystem":"crates.io","package":"ntru","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.3"},{"last_affected":"0.5.6"}]}]},{"source":"osv","ecosystem":"crates.io","package":"ntru","ranges":[{"type":"SEMVER","events":[{"introduced":"0.4.3"},{"last_affected":"0.5.6"}]}]},{"source":"osv","ecosystem":"crates.io","package":"ntru","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}]}],"references":[{"url":"https://github.com/FrinkGlobal/ntru-rs/issues/8","tags":["web","report"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0032.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-fq33-vmhv-48xh"},{"url":"https://github.com/FrinkGlobal/ntru-rs","tags":["package"]},{"url":"https://crates.io/crates/ntru","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-fq33-vmhv-48xh","title":"ntru-rs has unsound FFI: Wrong API usage causes write past allocated area","description":"The following usage causes undefined behavior.\n```rust\nlet kp: ntru::types::KeyPair = …;\nkp.get_public().export(Default::default())\n```\n\nWhen compiled with debug assertions, the code above will trigger a `attempt to subtract with overflow` panic before UB occurs.\nOther mistakes (e.g. using `EncParams` from a different key) may always trigger UB.\n\nLikely, older versions of this crate are also affected, but have not been tested.\n","status":"published","published":"2023-04-07T19:23:49Z","modified":"2023-04-07T19:23:52Z","updated_at":"2026-11-02T14:36:50.476488Z"}],"osv":[{"id":"GHSA-fq33-vmhv-48xh","title":"ntru-rs has unsound FFI: Wrong API usage causes write past allocated area","description":"The following usage causes undefined behavior.\n```rust\nlet kp: ntru::types::KeyPair = …;\nkp.get_public().export(Default::default())\n```\n\nWhen compiled with debug assertions, the code above will trigger a `attempt to subtract with overflow` panic before UB occurs.\nOther mistakes (e.g. using `EncParams` from a different key) may always trigger UB.\n\nLikely, older versions of this crate are also affected, but have not been tested.\n","status":"published","published":"2023-04-07T19:23:49Z","modified":"2023-11-08T04:19:06.3278Z","updated_at":"2026-11-02T15:46:46.760785Z"},{"id":"RUSTSEC-2023-0032","title":"Unsound FFI: Wrong API usage causes write past allocated area","description":"The following usage causes undefined behavior.\n```rust\nlet kp: ntru::types::KeyPair = …;\nkp.get_public().export(Default::default())\n```\n\nWhen compiled with debug assertions, the code above will trigger a `attempt to subtract with overflow` panic before UB occurs.\nOther mistakes (e.g. using `EncParams` from a different key) may always trigger UB.\n\nLikely, older versions of this crate are also affected, but have not been tested.","status":"published","published":"2023-03-22T12:00:00Z","modified":"2023-11-08T04:19:06.3278Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}