GHSA-p4v8-jgcv-9g75
Suggest an improvement- Source
- https://github.com/advisories/GHSA-p4v8-jgcv-9g75
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-p4v8-jgcv-9g75/GHSA-p4v8-jgcv-9g75.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-p4v8-jgcv-9g75
- Published
- 2024-01-03T21:40:45Z
- Modified
- 2024-01-03T21:40:45Z
- Summary
- safe_pqc_kyber leaks parts of secret keys
- Details
-
Impact
On some platforms, when an attacker can time decapsulation, and in particular when the attacker can forge cipher texts, they can learn (parts of) the secret key.
Does not apply to ephemeral usage, such as when used in the regular way in TLS.
Patches
Patched in 0.6.2.
References
- Database specific
{ "nvd_published_at": null, "cwe_ids": [], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-01-03T21:40:45Z" }- References
Affected packages
crates.io / safe_pqc_kyber
Package
- Name
- safe_pqc_kyber
- View open source insights on deps.dev
- Purl
- pkg:cargo/safe_pqc_kyber