GHSA-pqp6-f7wc-6498: 
Rust Analyse et atténuation de la vulnérabilité

Impact

In version 0.11.1 and earlier of vodozemac, Ed25519PublicKey::from_base64() and Ed25519SecretKey::from_base64() panic on malformed input instead of returning an error, if the input decodes to 31 or 33 bytes instead of the expected 32 bytes. An attacker who can supply a key to an application using vodozemac can crash it. Ed25519 public keys are routinely received from other Matrix users and servers, so a malicious party can publish a crafted key that crashes clients parsing it. The impact is limited to denial of service; no key disclosure or signature forgery is possible.

Patches

Fixed in 0.11.2.

Workarounds

Decode untrusted input yourself and check that it is exactly 32 bytes before passing it to vodozemac.