Rust advisories / magic-crypt
Vulnerability LowRUSTSEC-2024-0430 · magic-crypt
RUSTSEC-2024-0430: Use of insecure cryptographic algorithms
Short answerA security vulnerability in the magic-crypt crate: Use of insecure cryptographic algorithms. GitHub rates it Low. No fixed version: replace the crate or remove the affected code path.
| Crate | magic-crypt |
|---|---|
| Type | Vulnerability (crypto-failure) |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | Low (GitHub rating) |
| Published | 2024-12-28 |
| Last changed | 2025-10-28 |
| Also known as | GHSA-gmx7-gr5q-85w5 |
What to do
- Find who pulls it in:
cargo tree -i magic-crypt. - Avoid the affected API, or replace the crate.
Details from the advisory
This crate uses a number of cryptographic algorithms that are no longer considered secure and it uses them in ways that do not guarantee the integrity of the encrypted data.
MagicCrypt64 uses the insecure DES block cipher in CBC mode without authentication. This allows for practical brute force and padding oracle attacks and does not protect the integrity of the encrypted data. Key and IV are generated from user input using CRC64, which is not at all a key derivation function.
MagicCrypt64, MagicCrypt128, MagicCrypt192, and MagicCrypt256 are all vulnerable to padding-oracle attacks. None of them protect the integrity of the ciphertext. Furthermore, none use password-based key derivation functions, even though the key is intended to be generated from a password.
Each of the implementations are unsound in that they use uninitialized memory without MaybeUninit or equivalent structures.
For more information, visit the issue.
References
- Package: crates.io/crates/magic-crypt
- Advisory: rustsec.org/advisories/RUSTSEC-2024-0430.html
- Report: github.com/magiclen/rust-magiccrypt/issues/17
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?