blob: af6d0b9b45b73dbfe4bf03038eda492448d4f36c [file] [log] [blame]
id: GO-2023-2003
modules:
- module: github.com/supranational/blst
versions:
- introduced: 0.3.0
fixed: 0.3.11
vulnerable_at: 0.3.10
packages:
- package: github.com/supranational/blst/bindings/go
summary: Group signature validation bypass in github.com/supranational/blst
description: |-
When complemented with a check for infinity, blst skips performing a signature
group-check. Formally speaking, infinity is the identity element of the elliptic
curve group and as such it is a member of the group, so the group-check should
be performed. The fix performs the check even in the presence of infinity.
ghsas:
- GHSA-8c37-7qx3-4c4p
credits:
- Yunjong Jeong (@blukat29)
references:
- fix: https://github.com/supranational/blst/commit/fb91221c91c82f65bfc7f243256308977a06d48b
- web: https://github.com/supranational/blst/releases/tag/v0.3.11
review_status: REVIEWED