crates.io/sha2 CVE-2021-45696: high, EPSS 0.83%

Miscomputed sha2 results when using AVX2 backend

Action: Upgrade sha2 to 0.9.8 or later.

cargo update -p sha2 --precise 0.9.8

Affected

Fixed versions

Sources

• osv: GHSA-xpww-g9jx-hp8r
• https://github.com/RustCrypto/hashes/pull/314
• https://github.com/RustCrypto/hashes
• https://rustsec.org/advisories/RUSTSEC-2021-0100.html

CVE-2021-45696 · published 2022-06-17T00:19:35Z · modified 2023-11-08T04:07:22.441009Z · JSON