modules:
  - module: github.com/cloudflare/circl
    versions:
      - fixed: 1.3.3
    vulnerable_at: 1.3.2
    packages:
      - package: github.com/cloudflare/circl/abe/cpabe/tkn20/internal/tkn
        symbols:
          - EncryptCCA
      - package: github.com/cloudflare/circl/blindsign/blindrsa
        symbols:
          - RSAVerifier.Blind
      - package: github.com/cloudflare/circl/kem/frodo/frodo640shake
        symbols:
          - PublicKey.EncapsulateTo
        derived_symbols:
          - scheme.Encapsulate
          - scheme.EncapsulateDeterministically
      - package: github.com/cloudflare/circl/kem/kyber/kyber1024
        symbols:
          - PublicKey.EncapsulateTo
        derived_symbols:
          - scheme.Encapsulate
          - scheme.EncapsulateDeterministically
      - package: github.com/cloudflare/circl/kem/kyber/kyber512
        symbols:
          - PublicKey.EncapsulateTo
        derived_symbols:
          - scheme.Encapsulate
          - scheme.EncapsulateDeterministically
      - package: github.com/cloudflare/circl/kem/kyber/kyber768
        symbols:
          - PublicKey.EncapsulateTo
        derived_symbols:
          - scheme.Encapsulate
          - scheme.EncapsulateDeterministically
      - package: github.com/cloudflare/circl/kem/sike/sikep434
        symbols:
          - scheme.Encapsulate
      - package: github.com/cloudflare/circl/kem/sike/sikep503
        symbols:
          - scheme.Encapsulate
      - package: github.com/cloudflare/circl/kem/sike/sikep751
        symbols:
          - scheme.Encapsulate
summary: Kyber and FrodoKEM leak shared secret; blinding could be weak for tkn20 and
    blindrsa.
description: |
    When sampling randomness for a shared secret, the implementation of Kyber
    and FrodoKEM, did not check whether crypto/rand.Read() returns an error. In
    rare deployment cases (error thrown by the Read() function), this could lead
    to a predictable shared secret.

    The tkn20 and blindrsa components did not check whether enough randomness
    was returned from the user provided randomness source. Typically the user
    provides crypto/rand.Reader, which in the vast majority of cases will always
    return the right number random bytes. In the cases where it does not, or the
    user provides a source that does not, the blinding for blindrsa is weak and
    integrity of the plaintext is not ensured in tkn20.
cves:
  - CVE-2023-1732
ghsas:
  - GHSA-2q89-485c-9j2x
references:
  - advisory: https://github.com/cloudflare/circl/security/advisories/GHSA-2q89-485c-9j2x
  - fix: https://github.com/cloudflare/circl/commit/ff8d91225f8954b4970b6d6382d2e4c78f4a4cf8