GHSA-f6jh-hvg2-9525 – github.com/kudelskisecurity/crystals-go

Package

Manager: go
Name: github.com/kudelskisecurity/crystals-go
Vulnerable Version: >=0 <0.0.0-20240116172146-2a6ca2d4e64d

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS: N/A pctlN/A

Details

crystals-go vulnerable to KyberSlash (timing side-channel attack for Kyber) ### Impact On some platforms, when an attacker can time decapsulation of Kyber on forged cipher texts, they could possibly learn (parts of) the secret key. ### Patches Patched in https://github.com/kudelskisecurity/crystals-go/pull/21 ### Note This library was written as part of a MsC student project in the Cybersecurity Team at Kudelski Security. It is not actively maintained anymore. It is only intended for research and testing. We discourage its use in any production environment. Kudelski Security does not use this library as part of their commercial offers or product. This has now been clarified on the project's README. ### References https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/ldX0ThYJuBo http://kyberslash.cr.yp.to/

Metadata

Created: 2024-01-17T22:06:20Z
Modified: 2024-05-20T22:05:23Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-f6jh-hvg2-9525/GHSA-f6jh-hvg2-9525.json
CWE IDs: []
Alternative ID: N/A
Finding: F115
Auto approve: 1