Duplicate Advisory: cocoon Reuses a Nonce, Key Pair in Encryption

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-6878-6wc2-pf5h. This link is maintained to preserve external references.

Original Description

Versions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump functions are sequentially called. An attacker can generate the same ciphertext by creating a new encrypted message with the same cocoon object.

Note: The issue does NOT affect objects created with Cocoon::new which utilizes ThreadRng.