PT-2024-40455 · Pypqc · Pypqc

Published 2024-02-22 · Updated 2024-02-22

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions PyPQC versions prior to 0.0.6.1

Description An attacker able to submit many decapsulation requests against a single private key, and to gain timing information about the decapsulation, could recover the private key. A proof-of-concept exploit exists for a local attacker.

Recommendations For PyPQC versions prior to 0.0.6.1, upgrade to version 0.0.6.1 or newer, as it is a drop-in replacement with no known breaking changes.

Fix

Related Identifiers

GHSA-RC4P-P3J9-6577

Affected Products

Pypqc

References · 11

• https://osv.dev/vulnerability/GHSA-rc4p-p3j9-6577 · Vendor Advisory
• https://github.com/JamesTheAwesomeDude/pypqc/security/advisories/GHSA-rc4p-p3j9-6577 · Note
• https://github.com/JamesTheAwesomeDude/pypqc · Note
• https://github.com/JamesTheAwesomeDude/pypqc/commit/b33fec8cd36e865f8db6215c64b2d01f429a1ed6 · Note
• https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/hWqFJCucuj4/m/-Z-jm_k9AAAJ · Note
• https://github.com/pq-crystals/kyber/commit/dda29cc63af721981ee2c831cf00822e69be3220 · Note
• https://github.com/PQClean/PQClean/pull/534#event-11595728485 · Note
• https://github.com/pq-crystals/kyber/commit/11d00ff1f20cfca1f72d819e5a45165c1e0a2816 · Note
• https://kyberslash.cr.yp.to · Note
• https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/ldX0ThYJuBo/m/uIOqRF5BAwAJ · Note
• https://github.com/PQClean/PQClean/issues/533 · Note