Fixed versions are cryptsetup 2.4.3 and 2.3.7, which protect re-encryption metadata with a signature that nobody can forge without knowing the password.