{"action":"Upgrade secp256k1 to 0.22.2 or later.","affected":[{"fixed":"0.22.2","introduced":"0.14.0"},{"fixed":"0.23.5","introduced":"0.23.0"},{"fixed":"0.24.2","introduced":"0.24.0"}],"component":"secp256k1","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.22.2","0.23.5","0.24.2"],"ghsa_id":"GHSA-969w-q74q-9j8v","id":"tcs_01M5KF81RXN41PV70T3ZK88XAS","modified_at":"2023-11-08T04:17:44.447792Z","published_at":"2022-11-30T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2022-0070","https://crates.io/crates/secp256k1","https://rustsec.org/advisories/RUSTSEC-2022-0070.html","https://github.com/rust-bitcoin/rust-secp256k1/issues/543","https://github.com/rust-bitcoin/rust-secp256k1/pull/548"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"RUSTSEC-2022-0070","url":"https://osv.dev/vulnerability/RUSTSEC-2022-0070"}],"summary":"Unsound API in `secp256k1` allows use-after-free and invalid deallocation from safe code"}