{"action":"Upgrade github.com/consensys/gnark to 0.11.0 or later.","affected":[{"fixed":"0.11.0","introduced":"0"}],"component":"github.com/consensys/gnark","cve_ids":["CVE-2024-45039"],"ecosystem":"Go","epss":0.0019,"exploited":false,"fixed_versions":["0.11.0"],"ghsa_id":"GHSA-q3hw-3gm4-w5cr","id":"tcs_01M5KFJ7DQ2XV6TWEGW2BQ6PYV","modified_at":"2024-11-20T19:26:02Z","published_at":"2024-09-06T19:53:20Z","references":["https://osv.dev/vulnerability/GHSA-q3hw-3gm4-w5cr","https://github.com/Consensys/gnark/security/advisories/GHSA-q3hw-3gm4-w5cr","https://nvd.nist.gov/vuln/detail/CVE-2024-45039","https://github.com/Consensys/gnark/commit/e7c66b000454f4d2a4ae48c005c34154d4cfc2a2","https://github.com/Consensys/gnark","https://pkg.go.dev/vuln/GO-2024-3122"],"severity":{"label":"medium","score":6.2},"sources":[{"source":"osv","source_id":"GHSA-q3hw-3gm4-w5cr","url":"https://osv.dev/vulnerability/GHSA-q3hw-3gm4-w5cr"}],"summary":"gnark's Groth16 commitment extension unsound for more than one commitment"}