Go/github.com/consensys/gnark-crypto CVE-2023-44273: medium 5.1, EPSS 1.05%
gnark-crypto doesn't range check input values during ECDSA and EdDSA signature deserialization
Action: Upgrade github.com/consensys/gnark-crypto to 0.12.0 or later.
go get github.com/consensys/gnark-crypto@v0.12.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.12.0 | - |
Fixed versions
| 0.12.0 |
Sources
- osv: GHSA-fr8m-434r-g3xp
- https://github.com/Consensys/gnark-crypto/security/advisories/GHSA-fr8m-434r-g3xp
- https://nvd.nist.gov/vuln/detail/CVE-2023-44273
- https://github.com/Consensys/gnark-crypto/pull/449
- https://github.com/Consensys/gnark-crypto
- https://github.com/Consensys/gnark-crypto/releases/tag/v0.12.0
- https://go.dev/blog/defer-panic-and-recover
CVE-2023-44273 · published · modified · JSON