CVE-2024-36400: 
Rust vulnerability analysis and mitigation

A critical vulnerability was discovered in the nano-id Rust crate affecting versions prior to 0.4.0. The vulnerability involves incorrect generation of IDs using a reduced character set in the nano_id::base62 and nano_id::base58 functions, where base62 used only 32 symbols instead of 62, and base58 used only 16 symbols instead of 58. The vulnerability was disclosed on June 4, 2024, and has been assigned CVE-2024-36400 (GitHub Advisory).

The vulnerability is classified as CWE-331 and received a CVSS v3.1 score of 9.4 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. The technical issue stems from the nano_id::gen macro's inability to correctly handle custom character sets that are not a power of 2 in size. It's worth noting that the nano_id::base64 functionality remains unaffected by this vulnerability (GitHub Advisory).

The vulnerability results in a significant reduction in entropy, making the generated IDs more predictable and susceptible to brute-force attacks. This is particularly concerning when the IDs are used in security-sensitive contexts such as session tokens or unique identifiers (GitHub Advisory).

The vulnerability is highly exploitable with network attack vector, low attack complexity, requires no privileges, and needs no user interaction. This makes it particularly dangerous in networked environments where the nano-id crate is used for generating security-sensitive identifiers (GitHub Advisory).

The vulnerability has been patched in version 0.4.0 of the nano-id crate. The fix was implemented in commit a9022772b2f1ce38929b5b81eccc670ac9d3ab23, which updated the nano_id::gen macro to properly use all specified characters. Users are strongly advised to upgrade to version 0.4.0 or later (GitHub Commit, GitHub Advisory).