Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS05eGZxLThqM3IteHA1Z84AA2Hb

Consensys gnark-crypto allows Signature Malleability

Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and ECDSA signatures does not ensure that the data is in a certain interval.

Permalink: https://github.com/advisories/GHSA-9xfq-8j3r-xp5g
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05eGZxLThqM3IteHA1Z84AA2Hb
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: about 1 year ago
Updated: about 1 year ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Percentage: 0.00154
EPSS Percentile: 0.52501

Identifiers: GHSA-9xfq-8j3r-xp5g, CVE-2023-44273
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-44273
• https://github.com/Consensys/gnark-crypto/pull/449
• https://github.com/Consensys/gnark-crypto/releases
• https://verichains.io
• https://github.com/Consensys/gnark-crypto/releases/tag/v0.12.0
• https://github.com/advisories/GHSA-9xfq-8j3r-xp5g

Repository: https://github.com/Consensys/gnark-crypto
Blast Radius: 1.0

Affected Packages