RUSTSEC-2024-0430: 
Rust vulnerability analysis and mitigation

The vulnerability (RUSTSEC-2024-0430) affects the rust-magiccrypt crate, which was found to use multiple insecure cryptographic algorithms and implementations that do not guarantee data integrity. The issue was discovered and reported on December 28, 2024, highlighting significant security concerns in the crate's implementation up to version 4.0.1 (GitHub Issue).

The vulnerability encompasses multiple cryptographic implementation issues across different variants of the crate. MagicCrypt64 uses the broken DES block cipher and inappropriately uses CRC64 for key derivation. MagicCrypt128 implements AES-128-CBC but uses the insecure MD5 hash function for key and IV generation. MagicCrypt192 uses AES-192-CBC with the Tiger hash function, while MagicCrypt256 employs AES-256-CBC with SHA-256 for key hashing. None of these implementations include message authentication codes (MAC), making them vulnerable to padding oracle attacks due to their use of PKCS#7 without MAC. Additionally, there is undefined behavior in memory handling (GitHub Issue).

The vulnerabilities expose users to various security risks including potential data breaches through padding oracle attacks, susceptibility to modification attacks due to lack of message authentication, and possible exploitation through broken cryptographic algorithms. The use of insecure key derivation methods also makes the encrypted data vulnerable to brute force attacks (GitHub Issue).

Users are strongly advised against using this crate in its current state. For alternative solutions, it is recommended to use ChaCha20Poly1305 for encryption with Argon2id for key generation from passwords. When implementing these alternatives, it's crucial to never reuse ChaCha20Poly1305's nonce for the same key and always generate new random salts for Argon2id. For specific use cases, it is recommended to consult with a cryptographer (GitHub Issue).

Security researchers have recommended archiving the GitHub repository and other MagicCrypt libraries, along with adding clear warnings in the documentation about the security risks. The community has acknowledged these issues, with security experts confirming the severity of the vulnerabilities and supporting the creation of a security advisory (GitHub Issue).