PyPI/pypqc: high 8.2
pypqc private key retrieval vulnerability
Action: Upgrade pypqc to 0.0.6.1 or later.
pip install pypqc==0.0.6.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.0.4 | 0.0.6.1 | - |
Fixed versions
| 0.0.6.1 |
Sources
- osv: GHSA-rc4p-p3j9-6577
- https://github.com/JamesTheAwesomeDude/pypqc/security/advisories/GHSA-rc4p-p3j9-6577
- https://github.com/JamesTheAwesomeDude/pypqc
- https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/hWqFJCucuj4/m/-Z-jm_k9AAAJ
- https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/ldX0ThYJuBo/m/uIOqRF5BAwAJ
- https://kyberslash.cr.yp.to
- https://www.github.com/JamesTheAwesomeDude/pypqc/commit/b33fec8cd36e865f8db6215c64b2d01f429a1ed6
- https://www.github.com/PQClean/PQClean/issues/533
- https://www.github.com/PQClean/PQClean/pull/534#event-11595728485
- https://www.github.com/pq-crystals/kyber/commit/11d00ff1f20cfca1f72d819e5a45165c1e0a2816
- https://www.github.com/pq-crystals/kyber/commit/dda29cc63af721981ee2c831cf00822e69be3220
published · modified · JSON