GO-2022-1053

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2022-1053

Import Source

https://vuln.go.dev/ID/GO-2022-1053.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2022-1053

Aliases

GHSA-x279-68rr-jp4p

Published

2022-10-18T15:13:24Z

Modified

2024-05-20T16:03:47Z

Summary

Incorrect signatures in github.com/supranational/blst

Details

Potential creation of an invalid signature from correct inputs.

Some inputs to the blstfpeucl_inverse function can produce incorrect outputs. This could theoretically permit the creation of an invalid signature from correct inputs.

Database specific

{
    "url": "https://pkg.go.dev/vuln/GO-2022-1053",
    "review_status": "REVIEWED"
}

References

Affected packages

Go / github.com/supranational/blst

Package

Name: github.com/supranational/blst; View open source insights on deps.dev
Purl: pkg:golang/github.com/supranational/blst

Affected ranges

Type: SEMVER
Events: Introduced

0.3.0

Fixed

0.3.3

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/supranational/blst/bindings/go"
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2022-1053.json"