GHSA-9763-4f94-gfch – github.com/cloudflare/circl

Package

Manager: go
Name: github.com/cloudflare/circl
Vulnerable Version: >=0 <1.3.7

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS: N/A pctlN/A

Details

CIRCL's Kyber: timing side-channel (kyberslash2) ### Impact On some platforms, when an attacker can time decapsulation of Kyber on forged cipher texts, they could possibly learn (parts of) the secret key. Does not apply to ephemeral usage, such as when used in the regular way in TLS. ### Patches Patched in 1.3.7. ### References - [kyberslash.cr.yp.to](https://kyberslash.cr.yp.to/)

Metadata

Created: 2024-01-08T16:45:05Z
Modified: 2024-05-20T22:00:44Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-9763-4f94-gfch/GHSA-9763-4f94-gfch.json
CWE IDs: []
Alternative ID: N/A
Finding: F115
Auto approve: 1