GHSA-f6jh-hvg2-9525: Github.com/kudelskisecurity/crystals go Crystals-go Vulnerable To KyberSlash (timing Vulnerability
HIGHGHSA-f6jh-hvg2-9525 is a HIGH crystals-go vulnerable to kyberslash (timing vulnerability (General Security Weakness) affecting Github.com/kudelskisecurity/crystals go libraries in the Go ecosystem. The issue involves crystals-go vulnerable to kyberslash (timing side-channel attack for kyber). Remediation is available by upgrading affected packages to version 0.0.0-20240116172146-2a6ca2d4e64d.
GHSA-f6jh-hvg2-9525 at a Glance
How to Fix GHSA-f6jh-hvg2-9525
To remediate this vulnerability, upgrade all affected Github.com/kudelskisecurity/crystals go dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/kudelskisecurity/crystals-go to 0.0.0-20240116172146-2a6ca2d4e64dRun the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/kudelskisecurity/crystals-goHow to Check if You Are Affected
To determine whether your application is affected by GHSA-f6jh-hvg2-9525, inspect your project dependencies for Github.com/kudelskisecurity/crystals go:
inspect dependencies for github.com/kudelskisecurity/crystals-goAnalyze the terminal output to locate any version of Github.com/kudelskisecurity/crystals go in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.0.0-20240116172146-2a6ca2d4e64d), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under General Security Weakness. In Github.com/kudelskisecurity/crystals go, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-f6jh-hvg2-9525 Affected Github.com/kudelskisecurity/crystals go Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/kudelskisecurity/crystals-go
|
Go |
< 0.0.0-20240116172146-2a6ca2d4e64d
|
0.0.0-20240116172146-2a6ca2d4e64d
|
References
Frequently Asked Questions
What is GHSA-f6jh-hvg2-9525?
Which Github.com/kudelskisecurity/crystals go versions are affected?
What version fixes GHSA-f6jh-hvg2-9525?
Is github.com/kudelskisecurity/crystals-go affected?
What CWE is associated with GHSA-f6jh-hvg2-9525?
How can I check Go dependencies for GHSA-f6jh-hvg2-9525?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-f6jh-hvg2-9525",
"modified" : "2024-05-20T22:05:23Z",
"published" : "2024-01-17T22:06:20Z",
"aliases" : [ ],
"summary" : "crystals-go vulnerable to KyberSlash (timing side-channel attack for Kyber)",
"details" : "### Impact\nOn some platforms, when an attacker can time decapsulation of Kyber on forged cipher texts, they could possibly learn (parts of) the secret key.\n\n### Patches\nPatched in https://github.com/kudelskisecurity/crystals-go/pull/21\n\n### Note\nThis library was written as part of a MsC student project in the Cybersecurity Team at Kudelski Security. It is not actively maintained anymore. It is only intended for research and testing. We discourage its use in any production environment. Kudelski Security does not use this library as part of their commercial offers or product. This has now been clarified on the project's README.\n\n### References\nhttps://groups.google.com/a/list.nist.gov/g/pqc-forum/c/ldX0ThYJuBo\nhttp://kyberslash.cr.yp.to/",
"severity" : [ ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/kudelskisecurity/crystals-go"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.0.0-20240116172146-2a6ca2d4e64d"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/kudelskisecurity/crystals-go/security/advisories/GHSA-f6jh-hvg2-9525"
}, {
"type" : "WEB",
"url" : "https://github.com/kudelskisecurity/crystals-go/issues/19"
}, {
"type" : "WEB",
"url" : "https://github.com/kudelskisecurity/crystals-go/pull/20"
}, {
"type" : "WEB",
"url" : "https://github.com/kudelskisecurity/crystals-go/pull/21"
}, {
"type" : "WEB",
"url" : "https://github.com/kudelskisecurity/crystals-go/commit/2a6ca2d4e64d18dd6e8fbb4e48e22c2510118505"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/kudelskisecurity/crystals-go"
}, {
"type" : "WEB",
"url" : "https://kyberslash.cr.yp.to/faq"
} ],
"database_specific" : {
"cwe_ids" : [ ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2024-01-17T22:06:20Z",
"nvd_published_at" : null
}
}